October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108538 A security vulnerability has been detected in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108542 A vulnerability was found in 021is elvix-sdk up to 0.10.1. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-107756 The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Script... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107422 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105882 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-103988 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104106 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104107 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104110 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103852 Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability tha... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102501 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-15 |
| CVE-2026-103425 The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101926 The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101217 Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Lim... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-73596 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.5 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-93693 In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper valid... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-93694 In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of... |
medium | 4.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85115 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webser... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109285 Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerab... |
medium | 5.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109292 Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerab... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109300 Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vuln... |
medium | 4.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108606 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108611 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108616 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108621 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108626 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108636 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108641 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108646 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-108651 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-110465 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110466 Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-63156 Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74031 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the de... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-94506 Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-110764 AstronRPA through 1.1.6 contains an insecure direct object reference vulnerabili... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110774 Blinko through 1.8.8 contains a broken access control vulnerability in the /api/... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109641 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109646 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.