October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,517
Critical
3,162
High
7,208
Medium
7,048
Low
637
Severity not reported
4,462
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11795 Observable discrepancy vulnerability in Softtr Informatics Trading Limited Compa... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-106213 Race condition in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a rem... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-91810 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91818 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript ha... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91802 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
medium | 5.5 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91808 A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91796 The interface of Foxit PDF Editor/Reader lacks the permission verification for s... |
medium | 6.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-102135 On a Kiteworks Email Protection Gateway cluster with database replication enable... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102133 An optional, separately licensed repository-connector feature in Kiteworks Core... |
medium | 6.6 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-102124 A Kiteworks appliance setup interface did not enforce authentication once the ap... |
medium | 6.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-08 |
| CVE-2026-83431 Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite... |
medium | 5.4 | — | Oracle / product workbench | 2026-09-15 | 2026-10-08 |
| CVE-2026-103265 Fleet versions before 4.89.0 fail to properly filter MDM command results by team... |
medium | 4.3 | — | Fleetdm / fleet | 2026-10-01 | 2026-10-08 |
| CVE-2026-102505 Imager versions before 1.037 for Perl overflow a heap buffer fetching float samp... |
medium | 6.3 | — | Tonycoz / imager | 2026-10-01 | 2026-10-08 |
| CVE-2026-103001 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 6.5 | — | Pyjwt Project / pyjwt | 2026-09-30 | 2026-10-08 |
| CVE-2026-17646 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-106187 Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 all... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106179 UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106181 Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.... |
medium | 5.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106182 UI misrepresentation in Paint in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106183 Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106184 Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106185 Improper input validation in Viz in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106209 UI misrepresentation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106192 Information leak in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 all... |
medium | 4.6 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106299 Improper input validation in WebAudio in Google Chrome prior to 155.0.8059.39 al... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106306 Incorrect authorization in DevTools in Google Chrome prior to 155.0.8059.39 allo... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106307 Incorrect authorization in Network in Google Chrome prior to 155.0.8059.39 allow... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106242 Information leak in Omnibox in Google Chrome on on Android prior to 155.0.8059.3... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106244 Incorrect authorization in Permissions in Google Chrome prior to 155.0.8059.39 a... |
medium | 6.5 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106202 Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.80... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106206 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.80... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-60137 WordPress Core SQL Injection Vulnerability |
medium | 5.9 | Listed | WordPress / Core | 2026-07-17 | 2026-10-08 |
| CVE-2026-106063 A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-94114 Symbolic name not mapping to correct class. |
medium | 5.9 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79813 A local privilege escalation vulnerability exists in the ClearPass client softwa... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79814 An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard ag... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105749 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 6.5 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-105754 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105758 vLLM is an inference and serving engine for large language models. |
medium | 5.3 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105785 Joplin is an open source note-taking and to-do application that organises notes... |
medium | 4.8 | — | — | 2026-10-06 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.