October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,911
Critical
3,246
High
7,766
Medium
7,422
Low
713
Severity not reported
4,764
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-28659 In MicroXR Blobstore, there is a possible way to access other app's files due to... |
high | 7.8 | — | Google / android xr | 2026-09-08 | 2026-10-05 |
| CVE-2026-104974 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104979 Plane is an open-source project management tool. |
high | 8.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem int... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-92067 Use-after-free in the Widget: Gtk component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92072 Incorrect boundary conditions in the Safe Browsing component. |
high | 8.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92073 Privilege escalation in the Enterprise Policies component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92074 Mitigation bypass in the Popup Blocker component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92076 Incorrect boundary conditions in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-51914 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51917 FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code. |
high | 7.3 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51901 SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. |
high | 8.1 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51874 In Devika v1.0, the Patcher Agent save_code_to_project function contains a path... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-105630 Plane is an open-source project management tool. |
high | 8.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105633 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105635 Plane is an open-source project management tool. |
high | 7.4 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104971 Plane is an open-source project management tool. |
high | 8.5 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104975 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104977 Plane is an open-source project management tool. |
high | 7.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-103880 Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103878 Cleartext transmission of sensitive information vulnerability in Apache Director... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-102731 Memory allocation with excessive size value vulnerability in Apache Directory LD... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-92058 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92060 Use-after-free in the Internationalization component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92062 Privilege escalation in the Session Restore component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92064 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92065 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92047 Privilege escalation in the Crash Reporting component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92049 Use-after-free in the Widget: Win32 component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92052 Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL co... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92053 Privilege escalation in the Graphics: CanvasWebGL component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92054 Privilege escalation in the Memory component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92055 Privilege escalation in the DevTools component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92056 Use-after-free in the Graphics: Text component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92608 Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 messa... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92550 A pre-authentication attacker could leverage type size/count handling to cause e... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-105628 Plane is an open-source project management tool. |
high | 7.6 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-86938 A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed... |
high | 7.3 | — | Claris / filemaker pro | 2026-09-23 | 2026-10-05 |
| CVE-2026-92560 A pre-authentication attacker could leverage type size/count handling to cause e... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92564 A pre-authentication attacker could leverage type nesting to cause a StackOverfl... |
high | 7.5 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.