October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66874 For pull request events, Gitea reads workflow definitions from the pull request... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-63792 Gitea's collaborative-owner authorization path for reading cross-repository reus... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-60018 Gitea's OneDev migration downloader reads the entire remote version response int... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-62925 Gitea parses Alpine package uploads before enforcing package-size quotas and doe... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-63021 Gitea's Swift package parser limits each manifest to 128 KiB but does not limit... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-59766 Gitea's starred-repository and tracked-time API endpoints do not re-check curren... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-25946 When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and per... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110257 OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110213 Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object refere... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110229 QloApps through 1.7.0 contains an improper access control vulnerability in Admin... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110234 Elio through 1.13.0 contains an insecure temporary file vulnerability that allow... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110239 Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability i... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110254 Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerabili... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109890 Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor pre... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108680 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108692 1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vu... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108700 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108705 CordysCRM through 1.9.3 contains a missing authorization vulnerability in the PO... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108640 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108645 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCat... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108650 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108655 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Qu... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108660 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108665 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108670 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the pr... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108675 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108605 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108610 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108615 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108620 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108625 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108630 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDep... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108635 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GE... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108158 plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the wh... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability th... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108579 OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allo... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108585 argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerab... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-106327 Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.1 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-102988 Plane is an open-source project management tool. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.