October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,039
Critical
3,131
High
7,102
Medium
6,936
Low
617
Severity not reported
4,253
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108555 PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP tha... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108582 GenOffice through 0.11.505 contains an incorrect permissions vulnerability in it... |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerab... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerabili... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108599 phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108604 Tabularis through 0.27.0 contains an incorrect authorization vulnerability in th... |
medium | 6.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108690 mall4j through 4.0 contains an information disclosure vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108691 mall4j through 4.0 contains an improper authorization vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108696 CoreShop through 1.5.5 contains an authorization bypass vulnerability in the Ord... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108706 eladmin through commit 55fbf70 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108710 NornicDB through 1.4.1 contains a missing authorization vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108711 Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerabil... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability... |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108719 LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerabi... |
medium | 5.0 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108721 Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity h... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108722 open-computer-use through commit 610bac8 contains a stored cross-site scripting... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108724 Sylius through 2.3.0 contains an authorization bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108725 Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulne... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108727 EdgeEver through 1.108.0 contains a missing authorization vulnerability in the H... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108729 Corteza through 2024.9.10 contains an incorrect authorization vulnerability in c... |
medium | 5.9 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108730 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in lega... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108731 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that al... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108732 Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108734 Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108742 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108751 MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the... |
medium | 4.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108756 Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability i... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108757 Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authent... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108697 CoreShop through 2026.2.2 contains a missing authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108698 hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability i... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108850 Company Research Agent through 2.2.0 contains a server-side request forgery vuln... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108852 Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allow... |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108855 UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108856 UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108858 Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnera... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability th... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.