October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107708 MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the... |
medium | 4.9 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107399 The Mechanize library is used for automating interaction with websites. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107718 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS fra... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107651 A flaw was found in Eye of GNOME (eog). |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107393 FreeScout is a self-hosted help desk and shared mailbox. |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-104079 Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107292 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.4 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-14 |
| CVE-2026-107301 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107287 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-14 |
| CVE-2026-70196 Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attack... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-88763 A flaw was found in the skupper-router component of Red Hat Service Interconnect... |
medium | 5.9 | — | — | 2026-09-10 | 2026-10-13 |
| CVE-2026-69877 Origin validation error in Azure DevOps allows an unauthorized attacker to discl... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105731 Use of uninitialized resource in Microsoft Graphics Component allows an authoriz... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105726 Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclo... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-102851 Incorrect privilege assignment in Visual Studio Code allows an authorized attack... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-102229 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-85835 Buffer over-read in Servicing Stack Updates allows an authorized attacker to dis... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-84320 Nginx UI is a web user interface for the Nginx web server. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-70264 Improper link resolution before file access ('link following') in Microsoft Defe... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-106504 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-108614 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108619 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108624 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108629 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108631 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108634 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108639 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108644 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108649 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the qu... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108654 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Os... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108656 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108659 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108661 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108664 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108666 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the de... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108669 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the em... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108671 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108676 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108679 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the se... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108868 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.