October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106307 Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allow... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106242 Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.3... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106244 Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106202 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.80... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106206 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.80... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-60137 WordPress Core SQL Injection Vulnerability |
medium | 5.9 | Listed | WordPress / Core | 2026-07-17 | 2026-10-08 |
| CVE-2026-106063 A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-94114 Symbolic name not mapping to correct class. |
medium | 5.9 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79813 A local privilege escalation vulnerability exists in the ClearPass client softwa... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79814 An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard ag... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105749 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 6.5 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-105754 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105758 vLLM is an inference and serving engine for large language models. |
medium | 5.3 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105785 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105694 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105743 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.8 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-105705 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105447 A flaw was found in Quay. |
medium | 5.5 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105472 A weakness has been identified in girishsaraf Online-Appointment-Booking-System... |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-104044 A flaw was found in sssd. |
medium | 6.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-104035 A flaw was found in SSSD. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-95386 TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95388 Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serv... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95390 PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95391 ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95392 MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95393 CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95394 Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95395 IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-105753 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105755 vLLM is an inference and serving engine for large language models. |
medium | 4.2 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105756 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105757 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-106222 Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-93679 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97671 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-106223 Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
ca... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75805 Issue summary: A CMP client that requests certificate revocation on the basis
of... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75804 Issue summary: OpenSSL QUIC stack does not enforce connection
level flow control... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.