October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,474
Critical
3,283
High
7,907
Medium
7,596
Low
741
Severity not reported
4,947
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100760 Sandbox escape in the Security: Process Sandboxing component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-74043 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104028 The Anton Extensions WordPress plugin through 1.2.2 does not perform any capabil... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81649 The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84251 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not hav... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84252 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have au... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84253 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not h... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84254 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84734 The Mindstien Quick Login WordPress plugin through 1.0 does not correctly valida... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84737 The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the ac... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85118 The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enfor... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85121 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86706 The Quick quotes WordPress plugin through 1.0.0 does not perform any capability... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86717 The Insurify WordPress plugin through 1.0 does not have authorisation and nonce... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108576 A vulnerability was found in TOZED X300 up to 6.01.3. |
critical | 10.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2025-1675 The function dns_copy_qname in dns_pack.c performs performs a memcpy operation w... |
critical | 9.1 | — | Zephyrproject / zephyr | 2025-02-25 | 2026-10-13 |
| CVE-2026-106294 Incomplete cleanup in Chromoting in Google Chrome on on Mac prior to 155.0.8059.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-13 |
| CVE-2026-108893 A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106016 Mitigation bypass in the File Handling component. |
critical | 9.8 | — | Mozilla / firefox | 2026-10-06 | 2026-10-13 |
| CVE-2026-100762 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100763 Incorrect boundary conditions in the Graphics: WebGPU component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2022-33186 A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j,... |
critical | 9.8 | — | Broadcom / fabric operating system | 2022-12-08 | 2026-10-13 |
| CVE-2026-82162 Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper... |
critical | 9.8 | — | Dell / command\|configure | 2026-10-06 | 2026-10-13 |
| CVE-2026-86360 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
critical | 9.6 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-5759 A double free and use-after-free vulnerability in the RdbLoadDeletedNodes functi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-81535 In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/interna... |
critical | 9.1 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-87659 A critical authorization bypass vulnerability exists in the Management Server ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-55675 The Salty documentation repository builds and deploys the docs.saltbox.dev websi... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-39785 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-108915 A vulnerability has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108917 A vulnerability was determined in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108907 A vulnerability was determined in Netcore NR268 1.7.121109. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-107780 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107722 fast-jwt provides fast JSON Web Token (JWT) implementation. |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-73278 Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challe... |
critical | 9.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-94205 Gitea Actions decided whether a fork pull request run needed approval based on t... |
critical | 9.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-76779 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-95106 Gitea accepted pushed Git trees containing two entries with the same name, which... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-65162 NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes P... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65173 NVIDIA AIStore for Linux contains a missing authentication vulnerability in the... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.