October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87667 An argument injection vulnerability exists in the configuration management comma... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87685 An arbitrary file manipulation vulnerability exists in the WebTools management i... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2025-71418 PocketMine-MP versions before 5.25.2 fail to limit the explode() function in pac... |
medium | 5.3 | — | — | 2026-09-09 | 2026-10-14 |
| CVE-2025-63842 A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico a... |
medium | 5.4 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2025-68624 N-able Mail Assure through April 2026 contains a design-level authorization flaw... |
medium | 4.3 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2025-24890 gitoxide is an implementation of git written in Rust. |
medium | 6.8 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2025-36591 Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior t... |
medium | 4.4 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2025-13533 The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-... |
medium | 4.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-15696 The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape seve... |
medium | 6.8 | — | — | 2026-09-23 | 2026-10-14 |
| CVE-2026-87675 An OS command injection vulnerability exists in the configuration management sub... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-5769 A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS sw... |
medium | 4.1 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-103820 CAI Content Credential is affected by an Improper Limitation of a Pathname to a... |
medium | 5.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-106340 Missing authorization in CredentialProvider in Google Chrome on on Windows prior... |
medium | 4.6 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability... |
medium | 4.2 | — | Imagemagick / imagemagick | 2026-10-03 | 2026-10-14 |
| CVE-2026-102426 Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter... |
medium | 6.1 | — | Ollyo / sp page builder | 2026-10-05 | 2026-10-14 |
| CVE-2026-106343 Improper state validation in Autofill AI in Google Chrome on on Android prior to... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106344 Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 all... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106345 Use of released resource in Session in Google Chrome prior to 155.0.8059.39 allo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106348 Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-87426 An unauthenticated network-based attacker can query specific internal management... |
medium | 4.3 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Broc... |
medium | 6.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-106351 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 155.0... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-102776 Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of t... |
medium | 4.3 | — | Svenbluege / event gallery | 2026-10-05 | 2026-10-14 |
| CVE-2026-102778 Joomla Extension - svenbluege.de - Cross-site scripting and open redirect on the... |
medium | 6.1 | — | Svenbluege / event gallery | 2026-10-05 | 2026-10-14 |
| CVE-2026-106353 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.80... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106354 Improper resource exposure in Extensions in Google Chrome prior to 155.0.8059.39... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106355 Missing authorization in Media in Google Chrome on on Windows prior to 155.0.805... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-102777 Joomla Extension - svenbluege.de - Server-side request forgery in the Google Pho... |
medium | 6.5 | — | Svenbluege / event gallery | 2026-10-05 | 2026-10-14 |
| CVE-2026-106356 Clickjacking in EVP in Google Chrome prior to 155.0.8059.39 allowed a remote att... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106359 Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106360 Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106361 Incorrect provision of specified functionality in Mobile in Google Chrome on on... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106362 Missing authorization in DevTools in Google Chrome prior to 155.0.8059.39 allowe... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106364 Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allow... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106365 Missing authorization in Animation in Google Chrome prior to 155.0.8059.39 allow... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106366 Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106368 UI misrepresentation in UI in Google Chrome on on Android prior to 155.0.8059.39... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106369 Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allow... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-106370 Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-94348 Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Ne... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.