October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,423
Critical
3,147
High
7,191
Medium
7,024
Low
633
Severity not reported
4,428
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101046 Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list... |
medium | 4.3 | — | Fleetdm / fleet | 2026-09-27 | 2026-10-07 |
| CVE-2026-101047 Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS a... |
medium | 5.3 | — | Fleetdm / fleet | 2026-09-27 | 2026-10-07 |
| CVE-2026-93537 A user who can supply bundle content to a repository referenced by a GitRepo res... |
medium | 6.5 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-62179 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-39600 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Mehul Gohil... |
medium | 4.7 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-45161 wger is a free, open-source workout and fitness manager. |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107272 Gophish through 0.12.1 contains stored and reflected cross-site scripting vulner... |
medium | 4.7 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107121 A flaw was found in the SMTP email configuration handling of the keycloak-servic... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107167 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107174 A flaw was found in source-to-image. |
medium | 6.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106453 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106454 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105138 Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulne... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93539 A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webho... |
medium | 5.4 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-93540 A privilege mismatch was found in Fleet. |
medium | 6.5 | — | Suse / rancher fleet | 2026-09-28 | 2026-10-07 |
| CVE-2026-91181 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-95666 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-22 | 2026-10-07 |
| CVE-2026-96259 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 5.5 | — | Mattermost / mattermost server | 2026-09-22 | 2026-10-07 |
| CVE-2026-96260 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-22 | 2026-10-07 |
| CVE-2026-10542 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-18124 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
| CVE-2026-10556 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 5.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-11993 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-12882 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-9226 Authentication bypass in the Azure AD external login flow in Devolutions Server... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-82358 RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO (Service... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-82357 RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protoco... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-65122 NVIDIA TensorRT contains a vulnerability where an attacker can cause an out of b... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105811 Authorization bypass through a user-controlled key in the optional Amazon Q Busi... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106032 Server-side request forgery in the OpenAPI schema processing of the agent import... |
medium | 5.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102141 Two Kiteworks Core cluster-management operations did not validate file paths sup... |
medium | 6.7 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102666 The Joyland AI app contains hard-coded credentials for the GeTui push notificati... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-102668 The Joyland AI app accepts any TLS certificates from any server without validati... |
medium | 5.3 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-13417 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-14259 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-14344 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-15814 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2026-41958 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract fu... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42532 A path traversal vulnerability exists in the EmailSheet extract_parts functional... |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-18131 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.