October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2022-51016 PocketMine-MP 3.x (before 3.27.0) does not implement Minecraft Bedrock protocol... |
medium | 6.1 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2021-48007 PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MoveP... |
medium | 6.5 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2022-51010 PocketMine-MP versions before 4.4.2 fail to properly validate item IDs received... |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51011 PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat... |
medium | 4.3 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2020-37277 PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability i... |
medium | 6.5 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2026-67409 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-67408 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-66073 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-20525 In Modem, there is a possible system crash due to improper input validation. |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20527 In Modem, there is a possible system crash due to a missing bounds check. |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-107637 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorizat... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105832 EspoCRM before 10.0.6 contains an authentication bypass vulnerability that accep... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-18156 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-20543 In Modem, there is a possible information disclosure due to a logic error. |
medium | 5.5 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-11795 Observable discrepancy vulnerability in Softtr Informatics Trading Limited Compa... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-106213 Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-91810 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91818 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript ha... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91802 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91808 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91796 The interface of Foxit PDF Editor/Reader lacks the permission verification for s... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-102135 On a Kiteworks Email Protection Gateway cluster with database replication enable... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102133 An optional, separately licensed repository-connector feature in Kiteworks Core... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102124 A Kiteworks appliance setup interface did not enforce authentication once the ap... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-83431 Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite... |
medium | 5.4 | — | Oracle / product workbench | 2026-09-15 | 2026-10-08 |
| CVE-2026-103265 Fleet versions before 4.89.0 fail to properly filter MDM command results by team... |
medium | 4.3 | — | Fleetdm / fleet | 2026-10-01 | 2026-10-08 |
| CVE-2026-102505 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samp... |
medium | 6.3 | — | Tonycoz / imager | 2026-10-01 | 2026-10-08 |
| CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 6.5 | — | Pyjwt Project / pyjwt | 2026-09-30 | 2026-10-08 |
| CVE-2026-17646 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-106187 Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 all... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106179 UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106181 Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106182 UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106183 Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106184 Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106185 Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106209 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106192 Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 all... |
medium | 4.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106299 Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 al... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106306 Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allo... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.