October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,384
Critical
3,146
High
7,184
Medium
7,012
Low
629
Severity not reported
4,413
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105884 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-27434 Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals al... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-77121 A user account with permission to deploy artifacts to a hosted Maven repository... |
medium | 6.5 | — | Sonatype / nexus repository manager | 2026-09-02 | 2026-10-07 |
| CVE-2026-106254 Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39... |
medium | 5.1 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-102090 Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. |
medium | 4.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106413 Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remo... |
medium | 4.2 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106253 Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 al... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106251 UI misrepresentation in Chromoting in Google Chrome on on Mac prior to 155.0.805... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106415 Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a... |
medium | 4.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106416 Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a r... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106420 Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.... |
medium | 5.4 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-28667 In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due t... |
medium | 5.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-18179 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18180 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-18505 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to op... |
medium | 5.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-19087 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local... |
medium | 4.4 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-19267 IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to mi... |
medium | 6.2 | — | Ibm / financial transaction manager | 2026-09-23 | 2026-10-07 |
| CVE-2026-106033 A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Ansible Platf... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2025-43520 Apple Multiple Products Classic Buffer Overflow Vulnerability |
medium | 5.5 | Listed | Apple / Multiple Products | 2025-12-12 | 2026-10-07 |
| CVE-2025-66376 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability |
medium | 6.1 | Listed | Synacor / Zimbra Collaboration Suite (ZCS) | 2026-01-05 | 2026-10-07 |
| CVE-2026-81792 Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enq... |
medium | 6.5 | — | — | 2026-09-08 | 2026-10-07 |
| CVE-2026-98164 In the Linux kernel, the following vulnerability has been resolved:
KVM: x86/mm... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-29 | 2026-10-07 |
| CVE-2026-56098 A flaw was found in rubygem-katello. |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-12545 A flaw was found in rubygem-hammer_cli. |
medium | 6.7 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-102375 Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Expl... |
medium | 6.5 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-56952 In platform_msg_handler_init of default_msg_handlers.c, there is a possible perm... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105292 Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability... |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105186 A flaw has been found in itsourcecode Online Admission System 1.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95264 Feehi CMS 2.1.1 is vulnerable to Directory Traversal. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105174 A vulnerability has been found in Gerapy up to 0.9.13. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105178 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
medium | 4.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105161 A flaw has been found in invariant-systems-ai aiir up to 1.7.0. |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105145 A vulnerability has been found in Weaviate Verba up to 2.1.3. |
medium | 5.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-19856 The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-18161 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 4.3 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18170 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
medium | 6.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-82924 Improper Control of Interaction Frequency vulnerability in Pusula Communication,... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-12380 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105842 lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerability in proch... |
medium | 6.4 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.