October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulne... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110261 OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows a... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109172 yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109177 MoguBlog through 6.2 contains a broken access control vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109182 jshERP through 3.6 contains an incorrect authorization vulnerability in GET /sup... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109187 jshERP through 3.6 contains an information disclosure vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108814 A flaw has been found in SEMCMS up to 5.0. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108822 A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108827 A vulnerability was determined in Zen Cart up to 2.2.2. |
medium | 4.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108831 A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108889 A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. |
medium | 4.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108784 A vulnerability was detected in macrozheng mall up to 1.0.3. |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108788 A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108810 A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108779 A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-107754 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
medium | 6.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107433 Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oau... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103907 The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100193 The Tutor LMS – eLearning and online course solution plugin for WordPress is vul... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2025-13882 IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0... |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-1350 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could al... |
medium | 5.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-33141 IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated... |
medium | 6.5 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-33147 IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 co... |
medium | 5.9 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36045 IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a... |
medium | 4.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36076 IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 st... |
medium | 4.3 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36147 IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0... |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-36178 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could al... |
medium | 5.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-90995 A flaw was found in SSSD (System Security Services Daemon). |
medium | 5.5 | — | Fedoraproject / sssd | 2026-09-14 | 2026-10-14 |
| CVE-2026-110146 Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110143 Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 1... |
medium | 4.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110160 Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 all... |
medium | 4.2 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-21848 HCL BigFix Service Management is affected by a Security Misconfiguration vulnera... |
medium | 5.0 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-56595 HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerabili... |
medium | 4.3 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-110170 Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-56597 HCL BigFix Service Management is affected by a Sensitive Information Leakage vul... |
medium | 5.3 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-77816 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrat... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-35161 Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Rest... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-14855 The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
medium | 6.4 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-110258 OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110263 OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in Sign... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.