October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81154 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape imag... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81155 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a ga... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81156 The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting... |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-97688 urllib3 is an HTTP client library for Python. |
medium | 5.3 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-96204 Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110235 MP Manager through 1.1.0 contains a path traversal vulnerability that allows att... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110240 Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil... |
medium | 4.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110209 Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerab... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110219 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110224 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110230 XBackBone through 3.8.2 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108791 A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108768 A vulnerability was identified in zhayujie CowAgent up to 2.2.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108773 A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108778 A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108787 A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108701 1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108737 Traccar through 6.16.0 contains a weak password recovery vulnerability that allo... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108681 A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108521 A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108539 A vulnerability was detected in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108543 A vulnerability was determined in ag2ai ag2 up to 0.13.4. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108568 A vulnerability was determined in InstantSoft icms2 up to 2.18.2. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108572 A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-106436 The BSON encoder in the MongoDB PHP Driver does not check some return values aft... |
medium | 6.5 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-84290 IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validat... |
medium | 5.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-13 |
| CVE-2026-106287 Information loss in CORS in Google Chrome prior to 155.0.8059.39 allowed a remot... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-95630 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109409 A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109777 Information disclosure in the Storage: IndexedDB component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109779 Race condition in the Networking: DNS component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109781 Denial-of-service in the Printing: Output component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109768 Denial-of-service in the Site Reports component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109769 Information disclosure in the Networking: Cache component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109771 Information disclosure in the WebRTC: Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109773 Denial-of-service in the Sync component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109775 Denial-of-service in the WebRTC component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.