October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,171
Critical
3,135
High
7,164
Medium
6,958
Low
623
Severity not reported
4,291
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100279 In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed it... |
medium | 6.5 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100280 In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable... |
medium | 4.3 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notif... |
medium | 4.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-88892 In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with... |
medium | 5.0 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-93983 OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries,... |
medium | 5.0 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-93984 OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic... |
medium | 5.3 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2026-84386 A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 throug... |
medium | 5.1 | — | — | 2026-09-08 | 2026-10-02 |
| CVE-2026-80464 Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. |
medium | 4.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-79699 A flaw was found in the containers/storage library. |
medium | 4.4 | — | — | 2026-09-15 | 2026-10-02 |
| CVE-2026-80337 Missing Authorization vulnerability in HAVELSAN Inc. |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104466 YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in for... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104468 YesWiki before 4.6.7 contains an insufficient session expiration vulnerability t... |
medium | 4.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104446 YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104450 YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage act... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104452 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the... |
medium | 5.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104454 YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104458 YesWiki before 4.6.7 contains a server-side request forgery vulnerability in val... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104440 YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-95374 Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allow... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95382 Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowe... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95384 Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95385 Inappropriate implementation in PlatformIntegration in Google Chrome on on Windo... |
medium | 6.5 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2010-0738 Red Hat JBoss Authentication Bypass Vulnerability |
medium | 5.3 | Listed | Red Hat / JBoss | 2010-04-28 | 2026-10-02 |
| CVE-2026-81479 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Par... |
medium | 5.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-02 |
| CVE-2026-88265 A flaw was found in crun. |
medium | 5.6 | — | — | 2026-09-10 | 2026-10-02 |
| CVE-2026-104439 YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAc... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104451 YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in Revi... |
medium | 4.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104455 YesWiki before 4.6.7 contains an access control bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104459 YesWiki before 4.6.7 contains a server-side request forgery vulnerability in Web... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103505 Improper neutralization of argument delimiters in the volume handling component... |
medium | 6.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102797 Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addo... |
medium | 6.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102798 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-95360 Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remo... |
medium | 5.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95361 Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a re... |
medium | 4.3 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95363 UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allow... |
medium | 5.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-94405 Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Downl... |
medium | 5.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-76875 PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability... |
medium | 5.3 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-71973 U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_rea... |
medium | 5.2 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102906 A vulnerability was identified in 0xshariq github-mcp-server up to 52e764a7d66ea... |
medium | 6.3 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102846 A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789... |
medium | 4.7 | — | — | 2026-09-30 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.