October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62040 Missing Authorization vulnerability in DEV Institute Restrict User Access – Memb... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-109642 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109647 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109662 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109601 Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary f... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109609 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109622 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109627 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109632 Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109637 Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability tha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108940 A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2025-56566 MikroTik firmware 7.19.4 stores sensitive authentication credentials and network... |
medium | 4.6 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2025-36421 IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmit... |
medium | 5.9 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-71419 UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2025-71420 UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerabilit... |
medium | 4.3 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2025-14484 The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modifi... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-14486 The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletio... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-14487 The Handily plugin for WordPress is vulnerable to unauthorized payment settings... |
medium | 5.3 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-1280 The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal... |
medium | 6.5 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-32000 HCL Sametime is vulnerable to insufficient input sanitization. |
medium | 4.3 | — | — | 2026-09-24 | 2026-10-14 |
| CVE-2025-14814 The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-... |
medium | 6.4 | — | — | 2026-09-25 | 2026-10-14 |
| CVE-2025-71422 Contrast is a Kubernetes runtime for confidential containers. |
medium | 5.7 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-33207 NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, whe... |
medium | 6.8 | — | — | 2026-09-29 | 2026-10-14 |
| CVE-2025-14564 The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross... |
medium | 6.4 | — | — | 2026-09-30 | 2026-10-14 |
| CVE-2025-31980 HCL BigFix Service Management is affected by an Improper Input Validation vulner... |
medium | 4.3 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-14 |
| CVE-2025-71427 Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerabili... |
medium | 6.8 | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2025-12828 The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored... |
medium | 6.4 | — | — | 2026-10-03 | 2026-10-14 |
| CVE-2025-71384 Dbit WIFI4 N300 1.0.0 devices allows administrators (from the local Wi-Fi networ... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-70219 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88151 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88153 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-88172 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-76264 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76265 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Spl... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76267 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that hol... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76269 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-102596 Nango is an open-source platform for connecting agents and products to third-par... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108932 A vulnerability was determined in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2023-54407 Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.