October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84897 src/internal.c in wolfSSL wolfSSH through 1.5.0 admits the server-to-client Diff... |
medium | 5.3 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-90466 Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-control... |
medium | 6.5 | — | Apache / impala | 2026-10-07 | 2026-10-13 |
| CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in... |
medium | 5.3 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-107211 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107213 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107218 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.3 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107220 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107221 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107222 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-54459 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-17189 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.1 | — | Ibm / security verify access | 2026-10-08 | 2026-10-13 |
| CVE-2026-15399 The Animated Number Counters plugin for WordPress is vulnerable to generic SQL I... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109955 Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in se... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-107224 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-109654 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109659 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109664 Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability th... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109669 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109674 Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection v... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109624 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109629 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109634 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109639 Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109644 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109649 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109598 Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing auth... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109611 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109107 A weakness has been identified in Wavlink WL-WN592AX6 250422. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109144 A vulnerability was identified in wbond certvalidator up to 0.11.1. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109155 A flaw has been found in DeepPavlov up to 1.7.0. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108947 A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108960 A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3b... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108903 pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulne... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108938 A flaw has been found in code-projects Matrimonial System 1.0. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108770 A weakness has been identified in Appwrite up to 2.3.0. |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108775 A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108720 phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108578 A vulnerability was identified in Neterbit NW-431F 20250715. |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108683 A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2024-58391 Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vul... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.