October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead t... |
medium | 4.3 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated use... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-106266 Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allo... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106267 Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106286 Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OID... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109378 SPIP before 4.4.18 contains a server-side request forgery vulnerability in recup... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109340 SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108928 A security vulnerability has been detected in itsourcecode Online Admission Syst... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108726 GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.p... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108923 A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-89182 With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as priv... |
medium | 5.4 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-100766 Information disclosure in the Networking: JAR component. |
medium | 4.3 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-96594 The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote... |
medium | 6.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-97208 The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{r... |
medium | 4.9 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-87668 A stack-based buffer overflow vulnerability exists in the diagnostic execution u... |
medium | 6.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-9215 A cross site request forgery (CSRF) vulnerability in the listed NETGEAR models a... |
medium | 6.7 | — | Netgear / xr1000 firmware | 2026-09-08 | 2026-10-13 |
| CVE-2026-78015 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-87669 A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST A... |
medium | 4.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109658 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109663 Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109668 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109623 Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing author... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109628 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109638 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109643 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109648 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109602 Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scri... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109610 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109615 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109338 SurrealDB before 3.3.0 contains a denial of service vulnerability that allows qu... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109309 SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109324 Grav before 2.1.7 contains a denial of service vulnerability that allows authent... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109333 SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109179 jshERP through 3.6 contains a missing authorization vulnerability in LogControll... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109184 jshERP through 3.6 contains an improper authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108919 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108904 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclos... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108909 A security flaw has been discovered in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.