October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,608
Critical
3,170
High
7,235
Medium
7,072
Low
640
Severity not reported
4,491
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106506 Backstage is an open framework for building developer portals. |
medium | 5.3 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-09 |
| CVE-2026-106507 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106508 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-20542 In apusys, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20541 In Modem, there is a possible out of bounds read due to a missing permission che... |
medium | 5.3 | — | Mediatek / mt6985 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20540 In Modem, there is a possible out of bounds read due to a missing bounds check. |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20539 In Modem, there is a possible out of bounds read due to a missing bounds check. |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20538 In Modem, there is a possible out of bounds read due to a missing permission che... |
medium | 5.3 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20544 In meta, there is a possible out of bounds write due to a missing bounds check. |
medium | 6.8 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-96396 The Affinity by Canva application for macOS before 3.3.1 (October 2026 release)... |
medium | 4.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-81829 A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applicati... |
medium | 5.3 | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-92085 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107332 Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-103220 The Affinity by Canva application before 3.3.1 (October 2026 release) did not pe... |
medium | 4.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-101022 A Modbus connection feature on openPDC accepts a caller-specified destination ad... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-20537 In aidl, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | Mediatek / mt6878 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-107793 Jivejdon through 5.0 contains an authorization bypass vulnerability in Subscript... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107797 Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107800 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107828 Jivejdon through 5.0 contains an authentication bypass vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106376 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.80... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106333 Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-104628 Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expr... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105269 Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripti... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105275 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal v... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107715 The Mechanize library is used for automating interaction with websites. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107831 Jivejdon through 5.0 contains a cross-site request forgery vulnerability that al... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107714 The Mechanize library is used for automating interaction with websites. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107804 Nginx UI is a web user interface for the Nginx web server. |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108063 A flaw was found in libhangul. |
medium | 5.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-83443 Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component... |
medium | 6.5 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83433 Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (com... |
medium | 6.5 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-97332 The User Private Files WordPress plugin before 2.2.0 does not properly protect i... |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-09 |
| CVE-2026-96518 Missing Authorization vulnerability in properfraction ProfilePress wp-user-avata... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94665 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-19878 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-39779 Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allow... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107729 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107730 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107731 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.