October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109651 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side re... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109656 Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109661 Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109666 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109621 Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109626 Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109631 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109636 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109600 Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108943 A weakness has been identified in ModelTC LightX2V up to 0.5.0. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108948 A vulnerability has been found in code-projects Online Reviewer System 1.0. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108957 A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108939 A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102980 Plane is an open-source project management tool. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102389 Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2023-54411 Frappe framework before 13.32.0 uses weak authentication for print view access,... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2023-54406 Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the f... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109328 Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site script... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109329 Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access co... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109319 Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-s... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109322 Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulner... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109323 Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerabi... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-63148 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63171 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-91807 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-63157 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110600 xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerabili... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110614 Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110630 VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulner... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110658 Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in ms... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110713 libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_dec... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110718 TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vul... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110765 FlexPrice through 2.1.38 contains an authentication bypass vulnerability in Hand... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110766 Colanode server through 0.4.7 contains a path traversal vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110771 Shopizer through 3.2.5 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110772 Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103304 The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-103324 The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.