October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,320
Critical
3,272
High
7,879
Medium
7,569
Low
735
Severity not reported
4,865
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92142 Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which e... |
high | 8.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-105744 Docling simplifies document processing by parsing diverse formats and providing... |
high | 8.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105745 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-79809 An unauthenticated path traversal vulnerability exists in an API endpoint of Cle... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79799 A vulnerability in the web-based management interface of ClearPass Policy Manage... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-58704 Google Pixel Improper Authorization Vulnerability |
high | 8.8 | Listed | Google / Pixel | 2026-09-15 | 2026-10-07 |
| CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerab... |
high | 8.6 | Listed | Cisco / Unified Communications Manager | 2026-06-03 | 2026-10-07 |
| CVE-2026-106441 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-42714 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-43976 wger is a free, open-source workout and fitness manager. |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-15894 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/blueto... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103668 An SQL Injection vulnerability exists in the Site Search function of Movable Typ... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106228 Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-105750 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-77226 Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-42710 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107270 Gophish through 0.12.1 contains an insecure direct object reference vulnerabilit... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107181 Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnera... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106471 A flaw was found in Candlepin. |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106056 Rundeck before 6.2.0 contains an OS command injection vulnerability that allows... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-101154 An authenticated remote attacker with specific permissions can read or write fil... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102173 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93538 A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. |
high | 7.1 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-88808 A vulnerability has been identified within Rancher Manager where the Fleet agent... |
high | 8.8 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-18074 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18095 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 8.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18114 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-18123 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-78446 Use after free in Windows Distributed File System (DFS) allows an authorized att... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-07 |
| CVE-2026-69436 Heap-based buffer overflow in Windows State Repository Service allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-10-07 |
| CVE-2026-65142 NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause dese... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-51852 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in pytho... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-39730 Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploit... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105488 Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and e... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102100 Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting... |
high | 8.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102667 Joyland AI app allows an attacker with shared network access to inject JavaScrip... |
high | 8.3 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-106057 patool before 4.0.6 contains an OS command injection vulnerability on Windows be... |
high | 7.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-59347 VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerabilit... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107183 llama.cpp before b11393 contains a use-after-free and double free vulnerability... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-8821 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
high | 7.1 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.