October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110619 frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that a... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110212 Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability t... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110217 Lenve vhr through commit 03abbd3 contains an information disclosure vulnerabilit... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110228 wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerabil... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108870 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108875 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108880 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PU... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108885 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108577 A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108755 Hatchet through 0.110.5 contains an allocation of resources without limits vulne... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108682 A weakness has been identified in zhayujie CowAgent up to 2.1.6. |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108769 A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108774 A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-107798 jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-si... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107829 Jivejdon through 5.0 contains a weak password storage vulnerability that stores... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-108100 HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108104 Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulne... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107705 Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-103850 Substance3D - Stager is affected by an out-of-bounds read vulnerability that cou... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-88190 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88195 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88201 Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to di... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-97014 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-94214 A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-94216 A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2026-73273 Gitea's Maven upload handler reads checksum uploads entirely into memory and ret... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70406 Gitea's shared comparison helper omits the token repository-access check used wh... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70407 Gitea's organization-list API does not enforce the read:organization token scope... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-71301 Gitea's repository markup endpoint resolves same-repository pull request referen... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73126 Gitea's Actions workflow status badge endpoint does not enforce repository-read... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73130 Gitea does not limit the length of the gitignores field accepted by repository-c... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73135 Gitea uses inconsistent repository visibility predicates, and the condition used... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-67577 Gitea's activity-feed and contribution-heatmap API handlers do not apply the pro... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-68957 Gitea's API and web issue-search paths do not treat restricted accounts as anony... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-68964 Gitea's user SSH and GPG key-list API endpoints omit the profile visibility chec... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70400 Gitea's repository migration API accepts a public-only token when the request sp... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70402 Gitea creates server-side Git hook directories and scripts with mode 0777 and re... |
medium | 5.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-66849 Gitea's package registry grants authenticated users read access to packages owne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-66853 Gitea's user organization-list API includes Limited-visibility organizations for... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.