October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,967
Critical
3,122
High
7,084
Medium
6,906
Low
609
Severity not reported
4,246
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103930 cpp-httplib is a C++ header-only HTTP/HTTPS library. |
low | 3.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108981 ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in cer... |
low | 3.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65197 H3C HDM Family-A verifies the RSA signature of a firmware image against a public... |
low | 3.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-65200 The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP... |
low | 3.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77205 Libreswan in FIPS mode has a vulnerability where badly formed received certifica... |
low | 3.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110736 Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translatio... |
low | 3.6 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-93637 An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111581 A flaw was found in libblockdev. |
low | 3.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108603 slide-maker through 5.8.0 contains a path traversal vulnerability in generate_im... |
low | 3.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108736 Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability t... |
low | 3.7 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108741 Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guar... |
low | 3.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108745 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in Web... |
low | 3.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-110656 miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerabilit... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a p... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110661 CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_rea... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-82632 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9... |
low | 3.1 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-16 |
| CVE-2026-110660 vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111354 crmeb_java through 3.1 contains an authorization bypass vulnerability that allow... |
low | 3.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-91142 A flaw was found in Cockpit. |
low | 3.6 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-108933 A vulnerability was identified in Edimax BR-6208AC 1.32. |
low | 2.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108857 Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext loggin... |
low | 3.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-107848 Contao is an Open Source CMS. |
low | 3.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-101946 An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-77572 VeraCrypt provides disk encryption with strong security based on TrueCrypt. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111448 Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment... |
low | 3.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110191 The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110039 The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-w... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109401 The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-58242 SAP Cloud Connector contains an improper authorization check, which could be exp... |
low | 3.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107832 fastify is a fast and low overhead web framework for Node.js. |
low | 3.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110457 A malicious actor with access to the network and under certain conditions could... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110458 A malicious actor with access to the network and under certain conditions could... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109302 Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its Gr... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109365 Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability t... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-88842 A flaw was found in BusyBox dpkg. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-18418 The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc... |
low | 3.4 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-109195 A flaw was found in Quay. |
low | 3.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-88834 A flaw was found in BusyBox's httpd web server. |
low | 3.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-101991 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.