October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,384
Critical
3,146
High
7,184
Medium
7,012
Low
629
Severity not reported
4,413
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105680 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105696 Penpot is an open-source design and prototyping platform. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105114 OpenAM before 16.1.3 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105119 OpenAM before 16.1.3 applies its OAuth2 Provider PKCE enforcement only to author... |
medium | 6.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105124 W (vincent-peugnet/wcms) through 3.18.0 contains a stored cross-site scripting v... |
medium | 6.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105129 LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability tha... |
medium | 6.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-104872 OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecti... |
medium | 5.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105046 Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105029 UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object r... |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104982 A flaw has been found in Linux Mint Xreader up to 4.6.5. |
medium | 4.3 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105098 A security flaw has been discovered in Omega Solution CoinEx Crypto 2025. |
medium | 4.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-104612 A vulnerability was found in SourceCodester Student Result Management System 1.0... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104625 A security flaw has been discovered in CodeAstro Simple Loan Management System 1... |
medium | 6.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104461 YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104465 YesWiki before 4.6.7 contains a reflected cross-site scripting vulnerability tha... |
medium | 6.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104469 YesWiki before 4.6.7 contains a session fixation vulnerability that allows attac... |
medium | 6.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104475 IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerabilit... |
medium | 5.4 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104441 YesWiki before 4.6.7 contains an unauthenticated server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104449 YesWiki before 4.6.7 contains an access control vulnerability allowing unauthent... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104453 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-90907 Joomla! |
medium | 5.3 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-101126 Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4... |
medium | 6.5 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-67171 HCL BigFix Service Management is affected by an Information Disclosure vulnerabi... |
medium | 5.3 | — | Hcltech / bigfix service management | 2026-10-01 | 2026-10-06 |
| CVE-2026-92232 Joomla! |
medium | 6.5 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-92231 Joomla! |
medium | 6.7 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-92226 Joomla! |
medium | 6.0 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-92225 Joomla! |
medium | 6.7 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-92224 Joomla! |
medium | 6.7 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90918 Joomla! |
medium | 5.3 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90917 Joomla! |
medium | 5.3 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90915 Joomla! |
medium | 6.5 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90914 Joomla! |
medium | 6.4 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-90913 Joomla! |
medium | 5.5 | — | Joomla / joomla\! | 2026-09-29 | 2026-10-06 |
| CVE-2026-73599 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.4 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-06 |
| CVE-2026-76114 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
medium | 5.9 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-06 |
| CVE-2026-81453 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
medium | 6.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-81443 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Ser... |
medium | 6.4 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-80355 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cro... |
medium | 5.4 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-51878 deeptutor 1.4.0 contains an authorization bypass through a user-controlled objec... |
medium | 4.3 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-32576 Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.