October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,675
Critical
3,172
High
7,258
Medium
7,101
Low
646
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101968 An Integer Underflow (Wrap or Wraparound) vulnerability in the rpd process of Ju... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-67406 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67413 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-107820 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg tha... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-77364 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-106495 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104140 QGIS is a free, open source, cross-platform geographic information system. |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-77362 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102832 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-81507 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-p... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103975 Appium is a cross-platform automation framework for all kinds of apps, built on... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-92707 MessagePack for C# is a MessagePack serializer for C#. |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-96183 Missing authentication for critical function in Windows Health and Optimized Exp... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-67415 RabbitMQ is a messaging and streaming broker. |
medium | 4.9 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67419 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-88099 Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t... |
medium | 5.9 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69226 A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-67420 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-17525 Incomplete cleanup vulnerability in ABB My Control System. |
medium | 5.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106496 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-106497 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-15219 Authorization bypass through User-Controlled key vulnerability in SFM Software T... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-15575 Active debug code vulnerability in SFM Software Technologies Inc. |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-base... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110248 Insertion of sensitive information into log files in the git_utils[.]py componen... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110310 A remote user who can read encrypted objects in the S3 bucket can force a paddin... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-92228 The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_pe... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-94135 The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHo... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-96806 The Apache Airflow Keycloak auth manager did not end the session on logout: the... |
medium | 5.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111443 Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111449 Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDeb... |
medium | 5.9 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110366 Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews all... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110380 Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solu... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110896 Missing Authorization vulnerability in WP Chill Passster content-protector allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110900 Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allo... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110901 Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV Smart... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110903 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111397 Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsv... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111400 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.