October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,179
Critical
3,264
High
7,847
Medium
7,522
Low
728
Severity not reported
4,818
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105218 gopay before 1.5.119 disables TLS certificate verification in defaultClient() in... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105220 Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in... |
high | 7.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105221 The gist RubyGem before 6.1.0 contains an improper certificate validation vulner... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105222 The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certifi... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verificat... |
high | 7.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105293 Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105294 Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability tha... |
high | 7.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88392 Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104891 mppx-condition-gate provides conditional free-access wrappers for mppx payment m... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-12171 auto-changelog before 2.6.1 merges configuration from inside the target reposito... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104905 FacturaScripts before version 2026.7 contains a PHP object injection vulnerabili... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105761 Dify is an open-source LLM app development platform. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105762 Dify is an open-source LLM app development platform. |
high | 8.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105216 go-micro before 6.0.0 contains an improper certificate validation vulnerability... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service v... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105782 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-16335 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-16338 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-82896 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 7.6 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82893 IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated... |
high | 7.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82892 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82887 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82885 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-16428 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-25255 Exposed dangerous function lead to privilege escalation via gRPC server. |
high | 7.8 | — | Qualcomm / package manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-73547 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.5 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-06 |
| CVE-2026-84076 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 7.6 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84077 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84081 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84083 IBM Guardium Data Protection 12.2 is vulnerable to local privilege escalation vi... |
high | 7.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84084 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84085 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84086 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84089 IBM Guardium Data Protection 12.2 could allow a local attacker to gain elevated... |
high | 7.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-16466 IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-09-14 | 2026-10-06 |
| CVE-2026-84105 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 7.7 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84106 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
high | 8.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84108 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
high | 8.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.