October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,605
Critical
3,170
High
7,232
Medium
7,072
Low
640
Severity not reported
4,491
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106067 A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107313 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the prev... |
medium | 4.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107314 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107466 A flaw was found in flatpak-builder. |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107275 @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107604 A flaw was found in the installation provider and client registration endpoints... |
medium | 4.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107623 A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keyc... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-10631 An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suit... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-50055 A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106429 An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106430 The MongoDB C++ Driver discards content after an embedded NUL byte in certain fi... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106431 An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can... |
medium | 5.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106434 The explicit decryption component of MongoDB libmongocrypt can return an unrecog... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107297 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-54471 Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling... |
medium | 6.5 | — | Dell / smartfabric manager | 2026-09-17 | 2026-10-08 |
| CVE-2026-67101 HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF... |
medium | 5.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107229 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 4.0 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107285 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-67103 HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerab... |
medium | 6.1 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-20032 A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an... |
medium | 4.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20038 A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexu... |
medium | 5.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20173 A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote a... |
medium | 5.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20321 A vulnerability in the web-based management API for Cisco Application Policy Inf... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76437 A vulnerability in the web-based user interface of Cisco License On-Prem, former... |
medium | 4.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76452 A vulnerability in the web-based management interface of Cisco License On-Prem,... |
medium | 4.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76488 A vulnerability in the export policies functionality of Cisco Application Policy... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76286 In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splu... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-13224 A path traversal vulnerability in the Fireware OS WebUI management agent allows... |
medium | 4.9 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-18105 An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic t... |
medium | 6.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-86101 An improper authorization vulnerability in WatchGuard Fireware OS's SAML login p... |
medium | 6.5 | — | Watchguard / fireware | 2026-09-30 | 2026-10-08 |
| CVE-2026-32582 Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploitin... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-107702 QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHot... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache... |
medium | 6.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-46571 In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name()... |
medium | 5.5 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-101329 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-103360 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-107636 pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation v... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.