October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,384
Critical
3,278
High
7,871
Medium
7,568
Low
735
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-12516 Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: thro... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-30 | 2026-10-18 |
| CVE-2012-10063 Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in th... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-18 |
| CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability |
critical | 9.8 | Listed | BeyondTrust / Remote Support | 2026-10-15 | 2026-10-17 |
| CVE-2026-101950 A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63146 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-55562 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-100133 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-74040 Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53709 MCP Context Forge is an MCP gateway and administrative platform. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111711 Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111626 Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111641 FastapiAdmin through 3.0 contains an authentication bypass vulnerability that al... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109108 A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102692 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105903 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-76285 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-111673 IceCMS through 4.1.5 contains a missing authentication vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability t... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerabili... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111708 WhaTicket Community through commit cf04795 contains an authentication bypass vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111322 Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability tha... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111235 An authorization bypass vulnerability exists in the REST API of multiple version... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105037 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105038 The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services exp... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105039 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102693 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108261 Tina is a headless content management system. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. |
critical | 9.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex,... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-89309 The authorization middleware of the WMS MobileServer
fails to require authentica... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55695 FearlessCMS is a flat-file content management system centered on simplicity and... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55183 RClone Manager is a cross-platform GUI application designed to help users manage... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89310 A parameter taken from the request body is inserted into
a T-SQL statement witho... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary
consent names from una... |
critical | 9.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108390 Hestia Control Panel is a lightweight and powerful control panel for the modern... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55573 e107 is a content management system (CMS). |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105279 In the default configuration, the archive accepts DICOM associations from an unr... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.