October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,179
Critical
3,264
High
7,847
Medium
7,522
Low
728
Severity not reported
4,818
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100647 vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cac... |
high | 7.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100652 vLLM versions 0.22.0 through 0.23.0 fail to validate stop_token_ids against voca... |
high | 7.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-103623 Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-103631 Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-102271 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102272 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102273 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. |
high | 7.5 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. |
high | 8.2 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs... |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88360 libvips 8.19.0 contains a memory access vulnerability when processing little-end... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88355 An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88366 NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-52001 An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-105918 A vulnerability has been found in Kusalkasilva Learning-Management-System up to... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105919 A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb8... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105797 SimpleChat is a secure AI conversation application with personal and group works... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105392 A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105470 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105486 A vulnerability was detected in OSSRS srs up to 7.0-a1. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105314 Papermerge 3.5.3 allows remote code execution by a standard user via directory t... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105383 A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105387 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handl... |
high | 7.6 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-86134 A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentic... |
high | 7.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-92121 In the WSS4J streaming (StAX) code, a signature reference using the WS-Security... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-95616 An integer overflow in WSS4J's DER bounds check lets an oversized allocation pas... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-78861 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105839 libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105675 Ghost is a Node.js content management system. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105741 Langflow is a tool for building and deploying AI-powered agents and workflows. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105701 The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution i... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105386 A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105643 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105469 A vulnerability was determined in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104991 Phproject before 1.8.7 contains a missing object-level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104609 A weakness has been identified in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104845 Seroval facilitates JS value stringification, including complex structures beyon... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104445 YesWiki before 4.6.7 contains an authentication bypass vulnerability in the Acti... |
high | 8.2 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104457 YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar filter... |
high | 8.6 | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.