October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,608
Critical
3,170
High
7,235
Medium
7,072
Low
640
Severity not reported
4,491
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20535 In aidl, there is a possible escalation of privilege due to a missing permission... |
medium | 6.7 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20536 In aidl, there is a possible memory corruption due to use after free. |
medium | 6.7 | — | Mediatek / mt6878 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-106405 Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.... |
medium | 6.0 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106407 Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106408 Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-84244 IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulne... |
medium | 6.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Vulnerability |
medium | 4.9 | Listed | Strapi / Strapi | 2023-04-19 | 2026-10-09 |
| CVE-2026-84274 IBM Guardium Data Protection 12.2.2 is affected by a sensitive information expos... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-105922 A security flaw has been discovered in vllm-project vLLM up to 0.31.0. |
medium | 4.3 | — | Vllm / vllm | 2026-10-06 | 2026-10-09 |
| CVE-2026-25274 Memory Corruption when processing concurrent DMA buffer allocation and deallocat... |
medium | 6.7 | — | Qualcomm / aqt1000 firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25273 Memory Corruption when processing camera operations due to out-of-bounds write d... |
medium | 6.7 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25272 Memory Corruption when processing camera CRE driver operations with improper han... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25270 Memory corruption when processing command buffer requests with invalid length pa... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25269 Memory corruption when processing camera requests with excessive batch and IO bu... |
medium | 6.7 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25263 Memory corruption while processing IOCTL command called from user space to the k... |
medium | 6.6 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-39717 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-09 |
| CVE-2026-107778 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107379 savg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107395 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107298 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-90461 OpenStack Ironic through 38.0.0 may send a username and password to an unexpecte... |
medium | 6.3 | — | — | 2026-09-11 | 2026-10-09 |
| CVE-2026-106177 A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33... |
medium | 6.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-76061 A flaw was found in CRI-O's `bind_mount_prefix` handling. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-93448 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-106450 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106061 A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-105957 A vulnerability was detected in SourceCodester Performance Indicator System 1.0. |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105775 A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-107450 In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutatio... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-89191 Unsanitised input in
the "template name" field of SQLView KRIS's Workflow Templa... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-61801 The `github.com/moby/sys/user` package provides Go utilities for parsing and loo... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107353 traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107446 containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) int... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107608 Improper link resolution before file access in the asset bundling output handlin... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66082 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107706 Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44033 Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode()... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44034 A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/... |
medium | 4.4 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.