October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108119 A flaw was found in busybox. |
medium | 6.3 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108747 Lightdash through 2.556.0 contains an authorization bypass vulnerability that al... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-107830 Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107889 A flaw was found in the login theme rendering component of Keycloak. |
medium | 5.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107792 Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authori... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107799 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107335 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-co... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107397 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 4.4 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107717 Banks generates meaningful LLM prompts using a simple template language. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-104083 SmarterMail before build 9777 contains a stored mutation cross-site scripting vu... |
medium | 6.1 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-102663 OpenList is a file list program that supports multiple storage backends. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2023-54408 Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnera... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-87670 An authorization logic vulnerability exists in the Brocade Fabric OS versions be... |
medium | 4.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-100821 Site isolation issue in the Panning and Zooming component. |
medium | 4.7 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-108501 ZTE Z80 Ultra has a system interface permission verification defect. |
medium | 5.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108504 ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108506 ZTE Z80 Ultra's system interfaces do not have robust invocation authentication,... |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78013 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.3 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78340 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78027 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 6.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-89304 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89305 The paymendo WordPress plugin through 1.1 does not properly sanitize and escape... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-93550 The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who c... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-94235 The MemberHero WordPress plugin through 6.9 does not perform any capability or n... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-97183 The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-107791 The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84166 The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protectio... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84167 The Hotel Booking WordPress plugin through 3.8 does not verify that a booking re... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-89269 The WP Testimonials WordPress plugin through 1.4.13 does not properly escape tes... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-89271 The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the ty... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-67456 NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103417 Firefox for iOS could autofill saved credentials into a new page if cross-origin... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65131 NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-84321 Nginx UI is a web user interface for the Nginx web server. |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-77375 SFTPGo is an open source, event-driven file transfer solution. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105466 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-78404 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a loca... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104332 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-16678 IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120... |
medium | 4.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75076 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.