October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,320
Critical
3,272
High
7,879
Medium
7,569
Low
735
Severity not reported
4,865
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79800 An authenticated path traversal vulnerability exists in the command line interfa... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76748 A privilege escalation vulnerability exists in the API of AOS-S. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-59265 A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Co... |
high | 7.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-105468 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105571 A flaw has been found in PickMall Lilishop up to 4.2.4. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-95387 SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
high | 8.8 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95389 SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
high | 8.1 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-106220 Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106225 Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowe... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-84784 Issue summary: A malicious remote peer may flood the local QUIC
stack with NEW_C... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-84783 Issue summary: The first concurrent use of the same X.509 certificate by
several... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-84782 Issue summary: The DTLS retransmission logic does not correctly handle
a handsha... |
high | 8.2 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-72897 Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a
connection... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-54873 Issue summary: QUIC process may keep memory for QUIC packet
buffer for much long... |
high | 7.5 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-96419 Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serv... |
high | 7.8 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-46729 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor o... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-08 |
| CVE-2026-94651 improper handling of exceptional conditions, Missing release of resource after e... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-85494 Improper handling of length parameter inconsistency, Uncaught exception, Ineffic... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-105651 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105631 Plane is an open-source project management tool. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-83550 A flaw was found in postgres-exporter. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106058 GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105290 A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105385 A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105232 A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104890 Kunstmaan CMS is an open source content management system based on the Symfony f... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104973 Plane is an open-source project management tool. |
high | 7.6 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104978 Plane is an open-source project management tool. |
high | 8.2 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-101919 A flaw was found in the HyperShift operator. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-103504 Changing an organization team's permission through the API with only the `permis... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101917 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-101918 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-42713 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42708 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106550 Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Se... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2025-14174 Google Chromium Out of Bounds Memory Access Vulnerability |
high | 8.8 | Listed | Google / Chromium | 2025-12-12 | 2026-10-07 |
| CVE-2025-48572 Android Framework Privilege Escalation Vulnerability |
high | 7.8 | Listed | Android / Framework | 2025-12-08 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.