October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,674
Critical
3,172
High
7,258
Medium
7,101
Low
645
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89204 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89205 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89206 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89208 A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-103965 An issue in MongoDB Server's aggregation framework can cause certain constant va... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-104004 MongoDB Server's collection validation feature may not properly handle certain e... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-104005 A security issue was discovered in MongoDB mongos (the sharded cluster router) w... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-96297 Use of freed memory in the aggregation feature of MongoDB Server can cause the s... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-96299 A security issue was discovered in MongoDB mongos (the sharded cluster router) w... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107369 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origi... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107370 When a username for an Active Directory connection is a domain without a local p... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107371 When the authorize() method is called with a maxAge parameter, the auth0.js libr... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78628 The Okta Credential Provider for Windows does not validate a serialized credenti... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78632 The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERV... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110454 A malicious actor with access to the network could exploit an Improper Access Co... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110456 A malicious actor with access to the network and under certain conditions could... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108715 LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in incl... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-109307 Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnera... |
medium | 4.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109352 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in i... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109354 LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109364 Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows una... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-67236 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-61837 RabbitMQ is a messaging and streaming broker. |
medium | 5.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-85967 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-111141 zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_p... |
medium | 4.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110874 Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUn... |
medium | 6.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111123 FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allo... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109776 Race condition in the XPCOM component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110715 MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerabili... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109897 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110378 Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Cont... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109714 Incorrect boundary conditions in the Layout component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109723 Integer overflow in the Layout: Text and Fonts component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-103083 Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions E... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-66071 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-66078 RabbitMQ is a messaging and streaming broker. |
medium | 5.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-67222 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-103350 Improper Validation of Specified Quantity in Input vulnerability in Magepeople i... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108175 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110367 Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommer... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.