October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,768
Critical
3,176
High
7,280
Medium
7,128
Low
648
Severity not reported
4,536
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1426), linux (722), google (413), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98051 In the Linux kernel, the following vulnerability has been resolved:
net: bcmasp... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-98054 In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-100078 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-100079 In the Linux kernel, the following vulnerability has been resolved:
usb: typec:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-19 |
| CVE-2026-91205 A flaw was found in cockpit-files. |
medium | 6.0 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-91202 A flaw was found in cockpit-files. |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2025-55177 Meta Platforms WhatsApp Incorrect Authorization Vulnerability |
medium | 5.4 | Listed | Meta Platforms / WhatsApp | 2025-08-29 | 2026-10-18 |
| CVE-2026-86573 Out-of-bounds write vulnerability in Hitachi Disk Array Driver for AIX and Hitac... |
medium | 5.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-96425 Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run a... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-85747 Distribution is a toolkit to pack, ship, store, and deliver container content. |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-73814 Gitea's collaboration access-mode endpoint accepts the Owner access mode from an... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-78231 When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parame... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-78433 Gitea's web attachment handler skips its cross-repository ownership check for at... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-76113 Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an E... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-60021 Gitea's initial GitLab migration version probe uses an HTTP client without a tim... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-70396 Gitea's organization repository-creation API requires write:organization but omi... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-107381 svg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-111885 phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vul... |
medium | 5.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111886 phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the r... |
medium | 6.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111887 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enum... |
medium | 5.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111889 phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a mi... |
medium | 4.3 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2025-70819 Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a c... |
medium | 6.3 | — | — | 2026-09-13 | 2026-10-18 |
| CVE-2026-74032 Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability th... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-74047 Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63168 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-109665 Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109670 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-s... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109675 Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a b... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109625 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109630 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109635 Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109645 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109650 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109655 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109660 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints tha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108891 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108950 Open Source Social Network (OSSN) through 10.1 contains a missing authorization... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109181 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109599 Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108874 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.