October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,911
Critical
3,246
High
7,766
Medium
7,422
Low
713
Severity not reported
4,764
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100771 Undefined behavior in the DOM: Streams component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-92024 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-100772 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100773 Use-after-free in the Storage: IndexedDB component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100774 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100776 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-76728 A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow... |
high | 7.2 | — | — | 2026-09-29 | 2026-10-06 |
| CVE-2026-81669 IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerabi... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-48005 Missing authentication checks in mod_auth_digest in Apache Software Foundation A... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-81933 IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-94243 A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weak... |
high | 7.3 | — | Apache / sling security | 2026-09-23 | 2026-10-06 |
| CVE-2026-86243 Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake... |
high | 7.5 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-86247 Race condition within a thread vulnerability in Apache Tomcat Native allowed cli... |
high | 7.4 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-86926 A heap buffer overflow vulnerability in the FileMaker Server database engine blo... |
high | 7.8 | — | Claris / filemaker server | 2026-09-23 | 2026-10-06 |
| CVE-2026-81784 Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat al... |
high | 8.1 | — | — | 2026-09-10 | 2026-10-06 |
| CVE-2026-55232 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-54049 Sakai is a Collaboration and Learning Environment (CLE). |
high | 8.7 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-104437 Zebra before 4.4.0 contains a consensus divergence vulnerability in V5 transpare... |
high | 7.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104051 PictShare before 3.7.1 contains an information disclosure vulnerability that all... |
high | 8.2 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-104120 A security vulnerability has been detected in modelcontextprotocol mcp-server-fe... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104416 Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103761 Mooncake transfer engine through 0.3.13.post1 contains a memory exhaustion vulne... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-15911 Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a re... |
high | 7.4 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103283 Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability tha... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2024-58388 Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthentica... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103271 Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103246 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential... |
high | 7.7 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103250 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103262 Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerabi... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103266 Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, w... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-93354 Taskview Community before 1.56.0 contains a missing authentication vulnerability... |
high | 8.1 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-76782 Vulnerability in Drupal Screenshot. |
high | 7.3 | — | — | 2026-09-02 | 2026-10-05 |
| CVE-2026-105126 LaraDashboard before 1.4.8 contains an improper privilege management vulnerabili... |
high | 7.2 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-103100 Pexip Infinity before 40.1 is affected by improper input validation in the signa... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103101 Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input valid... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103102 Pexip Infinity before 41.0 is affected by improper input validation in the signa... |
high | 8.6 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103104 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103105 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper ac... |
high | 8.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103106 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper i... |
high | 7.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103108 Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper i... |
high | 7.5 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.