October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105864 Payload is a free and open source headless content management system. |
medium | 4.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105867 Payload is a free and open source headless content management system. |
medium | 6.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-84230 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a den... |
medium | 5.9 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-14521 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 4.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16177 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.3 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16182 IBM DataPower Gateway 10.5.0.0 through 10.5.0.0 through 10.5.0.22, 10.6.1 throug... |
medium | 5.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-106396 Improper input validation in Omnibox in Google Chrome on on Android prior to 155... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-15 |
| CVE-2026-107697 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer t... |
medium | 4.3 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-15 |
| CVE-2026-107698 FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forger... |
medium | 5.4 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-15 |
| CVE-2026-13257 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 6.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-13258 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.4 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14273 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 6.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate valida... |
medium | 4.8 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in t... |
medium | 5.9 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107677 FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demu... |
medium | 4.7 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_... |
medium | 4.7 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107695 FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer t... |
medium | 6.5 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107696 FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect(... |
medium | 6.5 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-82103 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-17484 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of s... |
medium | 5.5 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-17487 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user pro... |
medium | 5.3 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-18318 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-forc... |
medium | 5.3 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-18343 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP ta... |
medium | 4.4 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-93886 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to exec... |
medium | 5.4 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-16275 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-74768 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Si... |
medium | 4.1 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-68860 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance... |
medium | 6.8 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-85456 MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from... |
medium | 5.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85454 MOOS core-moos through 10.4.0 contains a buffer overflow vulnerability in CMOOSS... |
medium | 6.1 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85453 MOOS core-moos through 10.4.0 fails to escape database contents when rendering M... |
medium | 6.1 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-74769 Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrec... |
medium | 6.5 | — | Dell / powerprotect data manager | 2026-09-03 | 2026-10-14 |
| CVE-2026-55946 Ai command injection in Microsoft Copilot allows an unauthorized attacker to dis... |
medium | 5.9 | — | Microsoft / copilot | 2026-09-17 | 2026-10-14 |
| CVE-2026-103868 A flaw was found in pulp-container when it authenticates to an upstream registry... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-14 |
| CVE-2026-103869 A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-14 |
| CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-84247 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-9268 GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-92528 GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 be... |
medium | 4.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-85529 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-14210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.