October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,384
Critical
3,146
High
7,184
Medium
7,012
Low
629
Severity not reported
4,413
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105485 Authentication bypass OAuth device authorization flow in Devolutions Server 2026... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-95153 An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive infor... |
medium | 4.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-0198 In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a mi... |
medium | 4.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-55307 In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information discl... |
medium | 4.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-56936 In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds w... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-67421 RabbitMQ is a messaging and streaming broker. |
medium | 6.8 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-06 |
| CVE-2026-100648 vllm before 0.29.0 fails to enforce VLLM_MAX_AUDIO_CLIP_FILESIZE_MB limit in mul... |
medium | 5.3 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100649 vLLM before 0.29.0 contains a resource-limit bypass vulnerability in PyNvVideoCo... |
medium | 5.3 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100650 vLLM through 0.29.0 fetches and fully materializes remote or inline media before... |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-100651 vLLM before 0.29.0 fails to enforce decoder prompt-length validation on the disa... |
medium | 6.5 | — | Vllm / vllm | 2026-09-26 | 2026-10-06 |
| CVE-2026-103957 Server-side request forgery in the OAuth2 discovery handling in Loom for AWS bef... |
medium | 6.2 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103627 Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote... |
medium | 6.5 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-102269 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 5.4 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-102270 PyJWT is a Python implementation of JSON Web Token standards. |
medium | 4.9 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-06 |
| CVE-2026-88371 ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 12... |
medium | 5.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88383 libical 4.0.6 contains an incompatible function pointer in icalparameter_string_... |
medium | 6.2 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-88385 Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during m... |
medium | 6.5 | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-79311 webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja._... |
medium | 6.1 | — | — | 2026-09-22 | 2026-10-06 |
| CVE-2026-77802 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262... |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-77804 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262... |
medium | 6.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78862 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
medium | 6.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19954 Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-106041 Mooncake Store master through 0.3.13.post1 contains a missing authorization vuln... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105838 libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105707 A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105790 Microsoft UFO is an open-source framework for intelligent automation across devi... |
medium | 6.4 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105792 Microsoft UFO is an open-source framework for intelligent automation across devi... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105438 A flaw has been found in O2OA up to 10.0.1-ce. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105573 A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105703 A vulnerability was determined in PHPGurukul User Registration & Login and User... |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104893 Plane is an open-source project management tool. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104961 Plane is an open-source project management tool. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-101112 Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa... |
medium | 5.3 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-9812 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-06 |
| CVE-2026-94483 Next.js is a React framework for building full-stack web applications. |
medium | 6.5 | — | Vercel / next.js | 2026-10-02 | 2026-10-06 |
| CVE-2026-94543 Next.js is a React framework for building full-stack web applications. |
medium | 5.3 | — | Vercel / next.js | 2026-10-02 | 2026-10-06 |
| CVE-2026-82043 UTMStack before 11.2.16 contains an account enumeration vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-71298 A flaw was found in maestro. |
medium | 6.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105834 Rundeck before 6.2.0 contains a path traversal vulnerability that allows users h... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105648 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.