October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,731
Critical
3,174
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109311 vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback w... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109316 Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vu... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109204 LogicalDOC Community Edition through 9.3 contains an improper authorization vuln... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108759 mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistra... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108839 thClaws through 0.141.0 contains a link-following vulnerability in the post_inpu... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108854 Wanwu before 0.6.3 contains an insecure direct object reference vulnerability th... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108864 iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108869 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108713 SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108728 Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability tha... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108733 Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108738 Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability t... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108652 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108662 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108667 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108672 JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108677 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /s... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108689 Wukong AICRM through 20260610 contains a missing authorization vulnerability tha... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108694 ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108702 1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on P... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108612 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108617 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108622 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108627 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the lo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108632 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108637 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108642 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnn... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108647 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108165 Immich through 3.3.1 contains a missing authorization vulnerability in the partn... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108547 AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-s... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108581 TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerabilit... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108591 InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authen... |
medium | 4.4 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108596 OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authent... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108602 Helicone through v2025.08.21-1 contains a server-side request forgery vulnerabil... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108607 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability |
medium | 6.5 | Listed | Fortinet / Multiple Products | 2026-04-14 | 2026-10-17 |
| CVE-2026-63147 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63169 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 6.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-56826 Shopper is a Headless e-commerce Admin Panel. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-11713 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.