October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,911
Critical
3,246
High
7,766
Medium
7,422
Low
713
Severity not reported
4,764
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92033 Privilege escalation in Firefox for Android. |
high | 8.8 | — | Mozilla / firefox mobile | 2026-09-15 | 2026-10-05 |
| CVE-2026-92040 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92042 Race condition in the DOM: Content Processes component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92043 Privilege escalation due to incorrect boundary conditions in the Audio/Video com... |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92044 Information disclosure in the Networking: HTTP component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-63292 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apa... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache H... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Fo... |
high | 8.1 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Serv... |
high | 7.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-92046 Use-after-free in the Graphics component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-57099 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | Microsoft / asp.net core odata | 2026-09-08 | 2026-10-05 |
| CVE-2026-56589 HCL BigFix Service Management is affected by a Stored Cross-Site Scripting (XSS)... |
high | 7.2 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-67105 HCL BigFix Service Management is affected by an Insecure Communication vulnerabi... |
high | 7.4 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-05 |
| CVE-2026-55007 Double free in Microsoft Exchange Server allows an unauthorized attacker to exec... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-10-05 |
| CVE-2026-84739 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11... |
high | 8.7 | — | Gitlab / gitlab | 2026-09-29 | 2026-10-05 |
| CVE-2026-100813 Invalid pointer in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100814 Incorrect boundary conditions in the JavaScript Engine: JIT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100815 Use-after-free in the CSS Parsing and Computation component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100816 Site isolation issue in the DOM: Networking component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-97324 A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.... |
high | 7.3 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-91160 OpenWA is a free, open source, self-hosted WhatsApp API gateway. |
high | 8.2 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-94606 authentik is an open-source identity provider. |
high | 8.9 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-85057 ZITADEL is an open source identity management platform. |
high | 8.7 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-61815 zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* funct... |
high | 7.2 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-63645 OpenObserve is a cloud-native observability platform. |
high | 7.5 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-48070 Docmost is open-source collaborative wiki and documentation software. |
high | 7.1 | — | — | 2026-09-24 | 2026-10-05 |
| CVE-2026-105307 A vulnerability was detected in Casdoor up to 3.161.1. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105213 ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during... |
high | 8.2 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105147 A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. |
high | 7.3 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-104478 Formwork before 2.3.13 contains a path traversal vulnerability in BackupControll... |
high | 7.1 | — | — | 2026-10-03 | 2026-10-05 |
| CVE-2026-100637 SiYuan versions before v3.8.4 contain a path traversal vulnerability in the chec... |
high | 7.6 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100641 SiYuan before v3.8.4 does not HTML-escape stored flashcard block content before... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100608 Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboa... |
high | 8.3 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2023-54402 iDocView contains a server-side request forgery vulnerability in its /doc/upload... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-05 |
| CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an au... |
high | 8.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-100777 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100779 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-105211 ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V... |
high | 8.1 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-100596 OpenClaw versions before 2026.7.1 fail to properly authorize non-owner users exe... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-05 |
| CVE-2026-100580 OpenClaw (npm package 'openclaw') before 2026.7.1 improperly handles case sensit... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.