October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infe... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Ana... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java objec... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a pack... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireG... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) a... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd)... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105673 An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107725 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107734 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107735 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107736 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107716 Banks generates meaningful LLM prompts using a simple template language. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107386 amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-93860 In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-102368 Affected Tapo device firmware stores device-specific cryptographic material in p... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-39725 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105331 Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with a... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-15688 Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi... |
not reported | — | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-106104 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105844 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105828 Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an in... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93699 Argument injection in WP Toolkit for cPanel allows local users to execute arbitr... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-33586 Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allo... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the proj... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107378 CairoSVG is an SVG converter based on Cairo, a 2D graphics library. |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-97714 CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secur... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97715 CVE-2026-97715 is
a vulnerability in the client registration process of Secure A... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97716 CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97717 CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access serve... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-93858 In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox <... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.