October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,090
Critical
3,183
High
7,364
Medium
6,922
Low
714
Severity not reported
4,907
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97715 CVE-2026-97715 is
a vulnerability in the client registration process of Secure A... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97716 CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97717 CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access serve... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-93858 In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox <... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-12260 SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable co... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-4894 A vulnerability has been identified regarding insufficient validation in the Fra... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104634 Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKitty... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-88257 Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102488 In affected versions, Octopus Server incorrectly evaluates multiple scoped permi... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-92542 The firewall rules which mark VXLAN datagrams for encryption indiscriminately ma... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92543 Docker Engine classifies a registry hostname as insecure using an any-match DNS... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-101998 Docker Sandboxes could fail open while masking credentials in protected proxy re... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105452 Docker Sandboxes could forward a client-supplied credential alongside a credenti... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105570 Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when d... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107279 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107280 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107281 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-103663 Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insuff... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-86197 Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig san... |
not reported | — | — | — | 2026-09-05 | 2026-10-08 |
| CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-105689 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105699 Langflow is a tool for building and deploying AI-powered agents and workflows. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-107278 MISP contains a validation flaw in its object synchronization logic. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107276 MISP contains a race condition in the email-based one-time password (OTP) login... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-5703 Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, sp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-39768 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pai... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19572 A security vulnerability has been identified in FlexNet Publisher lmadmin. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models a... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripti... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107102 This vulnerability exists in the ERP system due to improper validation of paymen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107103 This vulnerability exists in the ERP system due to insufficient validation and p... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107104 This vulnerability exists in the ERP system due to unsafe deserialization of use... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102478 In affected versions of Octopus Server, an authenticated user with permission to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft T... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclip... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.