October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,730
Critical
3,173
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108719 LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerabi... |
medium | 5.0 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108721 Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity h... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108722 open-computer-use through commit 610bac8 contains a stored cross-site scripting... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108724 Sylius through 2.3.0 contains an authorization bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108725 Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulne... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108727 EdgeEver through 1.108.0 contains a missing authorization vulnerability in the H... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108729 Corteza through 2024.9.10 contains an incorrect authorization vulnerability in c... |
medium | 5.9 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108730 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in lega... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108731 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that al... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108732 Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108734 Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108742 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108751 MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the... |
medium | 4.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108756 Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability i... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108757 Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authent... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108697 CoreShop through 2026.2.2 contains a missing authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108698 hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability i... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108850 Company Research Agent through 2.2.0 contains a server-side request forgery vuln... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108852 Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allow... |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108855 UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108856 UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108858 Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnera... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability th... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108862 APIPark through 1.9.7-beta contains an insecure direct object reference vulnerab... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108951 LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108952 RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy... |
medium | 4.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109165 TDuck survey form through 6.0 contains a broken access control vulnerability tha... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109167 TDuck survey form through 6.0 contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109239 Crawl4AI before 0.9.4 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109424 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109375 Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109565 Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vuln... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109570 Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authenti... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110098 Jorani before 1.0.4 contains an insecure direct object reference vulnerability t... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110099 Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr con... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110103 bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110104 Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110109 JetLinks Community through 2.10.0 contains a missing authorization vulnerability... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.