October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,618
Critical
3,170
High
7,236
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75621 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
medium | 6.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-92832 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
medium | 5.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109166 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109173 yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109178 jshERP through 3.6 contains a missing authorization vulnerability in LogControll... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109183 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109188 jshERP through 3.6 contains a missing authorization vulnerability that allows lo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108926 A security flaw has been discovered in itsourcecode Baptism Information Manageme... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108834 A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108890 A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-100822 Spoofing issue in the Networking: HTTP component. |
medium | 5.4 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100826 Denial-of-service in the Storage: StorageManager component. |
medium | 6.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-95112 When processing issue and comment bodies, Gitea scanned the entire preceding tex... |
medium | 6.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96400 With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hos... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96589 When a private repository is transferred to a user who lacks access, Gitea grant... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104045 A flaw was found in SSSD. |
medium | 4.7 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-13 |
| CVE-2026-104046 A flaw was found in SSSD (System Security Services Daemon). |
medium | 6.2 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-13 |
| CVE-2026-107819 MariaDB Connector/C is a C and C++ client library for connecting applications to... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causin... |
medium | 6.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-108803 A security vulnerability has been detected in y_project RuoYi up to 4.8.3. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108811 A weakness has been identified in WMCMS 4.446.1257. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108824 A flaw has been found in DataEase up to 3.0.0. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108828 A vulnerability was identified in Zen Cart 2.2.2. |
medium | 4.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108781 A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108785 A flaw has been found in macrozheng mall up to 1.0.3. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108789 A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106331 Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106385 Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106381 Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106297 Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 al... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106418 Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-106586 In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was su... |
medium | 4.3 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-104633 When migrating a repository from another Gitea instance, Gitea used the page siz... |
medium | 6.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-105268 The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues... |
medium | 4.3 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106502 Backstage is an open framework for building developer portals. |
medium | 5.3 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-107387 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107289 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.8 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107290 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107291 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 4.3 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107293 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 5.3 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.