October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,674
Critical
3,172
High
7,258
Medium
7,101
Low
645
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110371 Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testi... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110890 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109689 Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110374 Missing Authorization vulnerability in Hamid Alinia Login with phone number logi... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18111 Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS)... |
medium | 6.1 | — | Concretecms / concrete cms | 2026-09-15 | 2026-10-15 |
| CVE-2026-91883 Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Inser... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92159 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-79841 A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-o... |
medium | 5.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79843 A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under ce... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-57491 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-19576 The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch poi... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-106585 In sshd and ssh in OpenSSH before 10.6, there is no check for whether the maximu... |
medium | 6.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-15 |
| CVE-2026-106150 In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-106138 In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-106139 In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-100350 kin-openapi is a Go project for handling OpenAPI files. |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2017-20283 NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-75063 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
medium | 5.4 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-103822 Substance3D - Designer is affected by an out-of-bounds read vulnerability that c... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103823 Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerabilit... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103824 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103825 Substance3D - Designer is affected by an out-of-bounds read vulnerability that c... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103826 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103827 Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerabilit... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103828 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103829 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-100116 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-48378 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-48377 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-83947 Missing authorization in Azure Event Grid allows an authorized attacker to perfo... |
medium | 6.5 | — | Microsoft / azure event grid | 2026-10-08 | 2026-10-15 |
| CVE-2026-87108 An authenticated Ops Manager user with a read-only project role can retrieve a d... |
medium | 4.3 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
| CVE-2026-100125 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.9 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-87109 An authenticated Ops Manager organization member can retrieve another member's p... |
medium | 6.5 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
| CVE-2026-87110 An unauthenticated user with network access to the Ops Manager web port can repe... |
medium | 5.3 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
| CVE-2026-18541 IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting... |
medium | 5.4 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-103537 Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty tem... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-75633 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-75634 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 4.3 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-75638 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 6.5 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
| CVE-2026-76194 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 4.3 | — | Adobe / c2pa | 2026-09-22 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.