October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,967
Critical
3,122
High
7,084
Medium
6,906
Low
609
Severity not reported
4,246
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79835 A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. |
low | 2.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-64856 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55184 EspoCRM is an open source customer relationship management application. |
low | 3.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-53575 EspoCRM is an open source customer relationship management application. |
low | 2.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110810 A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. |
low | 2.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109407 A security vulnerability has been detected in macrozheng mall up to 1.0.3. |
low | 3.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108908 A vulnerability was identified in Netcore NR268 1.7.121109. |
low | 2.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108808 A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. |
low | 2.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108935 A weakness has been identified in Edimax BR-6208AC 1.32. |
low | 2.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-110655 miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerabilit... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110762 bbPress before 2.6.19 contains an information disclosure vulnerability that allo... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-82153 Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of... |
low | 2.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108066 The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capabi... |
low | 2.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109332 Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in... |
low | 3.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-33920 A cross-site request forgery vulnerability was discovered in the login functiona... |
low | 3.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-107676 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability i... |
low | 3.3 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-100104 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3... |
low | 3.5 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-103549 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6... |
low | 2.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-94584 A race condition and thread-safety vulnerability exists in the web management da... |
low | 2.6 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2025-15695 The Translate WordPress with GTranslate WordPress plugin before 3.0.10 does not... |
low | 3.5 | — | — | 2026-09-11 | 2026-10-14 |
| CVE-2025-45480 Floodlight 71fe8a7 allows disruption of host communication via link spoofing. |
low | 3.0 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2025-64059 Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. |
low | 1.8 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2025-70820 Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders ot... |
low | 3.5 | — | — | 2026-09-13 | 2026-10-14 |
| CVE-2025-64031 libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzi... |
low | 2.5 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2025-26790 Withsecure Atlant with Capricorn engine before 2025-01-20_02 allows a Remote Den... |
low | 3.7 | — | — | 2026-09-14 | 2026-10-14 |
| CVE-2025-13166 The SMS OTP flow fails to adequately handle error messages, allowing an attacker... |
low | 3.7 | — | — | 2026-09-15 | 2026-10-14 |
| CVE-2026-108898 A vulnerability was detected in Netis WF2409E 3.3.42541. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108802 A weakness has been identified in y_project RuoYi up to 4.8.3. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-110141 Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed... |
low | 3.1 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110624 Papermerge Core through 3.5.3 contains a missing authorization vulnerability tha... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110604 Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in... |
low | 3.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-60008 Gitea's Jupyter notebook renderer inserts the notebook's language_info.name meta... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110262 OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110218 Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that all... |
low | 3.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110223 Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerabilit... |
low | 3.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110036 A flaw was found in device-mapper-persistent-data. |
low | 3.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108594 Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerabilit... |
low | 3.5 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-73791 A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer... |
low | 2.0 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73792 A security vulnerability in HPE NonStop Java JToolkit can allow command Injectio... |
low | 3.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106176 A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow atta... |
low | 3.8 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.