October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,416
Critical
3,281
High
7,882
Medium
7,582
Low
740
Severity not reported
4,931
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101980 An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS wi... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-70242 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-7826 A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-55684 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55680 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55683 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109686 Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109110 A flaw has been found in Wavlink WL-WN592AX6 250422. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108892 A vulnerability was determined in Linksys E1700 1.0.0.4.003. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108896 A vulnerability was found in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108804 A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03... |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-107908 A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107909 A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) a... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2017-5674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, a... |
critical | 9.8 | — | Embedthis / goahead | 2017-03-13 | 2026-10-15 |
| CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application lis... |
critical | 9.1 | — | Apache / tomcat | 2017-04-17 | 2026-10-15 |
| CVE-2026-97016 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97749 Double free in Microsoft Office Outlook allows an unauthorized attacker to execu... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-91881 Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improp... |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110536 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109694 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109688 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17618 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-110645 Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110650 The thumbnail Python package through 1.5 contains an OS command injection vulner... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109145 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109698 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109892 Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-16740 Missing authentication for critical function vulnerability in TR7 Cyber Defense... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-16741 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability |
critical | 9.8 | Listed | Progress / LoadMaster | 2026-06-04 | 2026-10-15 |
| CVE-2026-108918 A vulnerability was identified in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108914 A flaw has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gal... |
critical | 9.8 | — | Joomlaboat / youtube gallery | 2026-09-26 | 2026-10-15 |
| CVE-2026-102676 Electron is a framework for writing cross-platform desktop applications using Ja... |
critical | 9.8 | — | Electronjs / electron | 2026-09-29 | 2026-10-15 |
| CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-10-14 | 2026-10-15 |
| CVE-2026-92464 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-92909 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-48383 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-4800 The fix for CVE-2021-23337 added validation for the variable option in _.templat... |
critical | 9.8 | — | Lodash / lodash | 2026-03-31 | 2026-10-15 |
| CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the re... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.