October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,528
Critical
3,289
High
7,924
Medium
7,616
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105135 A vulnerability has been found in InternLM MindSearch 0.1.0. |
critical | 10.0 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-35053 OneUptime is an open-source monitoring and observability platform. |
critical | 9.8 | — | Hackerbay / oneuptime | 2026-04-02 | 2026-10-06 |
| CVE-2026-31818 Budibase is an open-source low-code platform. |
critical | 9.9 | — | Budibase / budibase | 2026-04-03 | 2026-10-06 |
| CVE-2026-35477 InvenTree is an Open Source Inventory Management System. |
critical | 9.9 | — | Inventree Project / inventree | 2026-04-08 | 2026-10-06 |
| CVE-2025-59872 HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the... |
critical | 9.8 | — | Hcltech / zie for web | 2026-06-17 | 2026-10-06 |
| CVE-2026-18162 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18163 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18169 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.9 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-86131 A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client... |
critical | 9.8 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-105845 Payload is a free and open source headless content management system. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106102 Quasar Framework is a framework for building high-performance Vue.js user interf... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105740 Langflow is a tool for building and deploying AI-powered agents and workflows. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88416 MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/f... |
critical | 9.8 | — | — | 2026-09-22 | 2026-10-06 |
| CVE-2026-88393 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export inter... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94293 An unauthenticated remote attacker can modify Asset Administration Shell submode... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-77178 Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bound... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105778 A vulnerability has been found in Tenda AC5 02.03.01.111_multi. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon Sag... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupport... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-89238 WSS4J EncryptedHeader child confusion could promote an attacker-controlled plain... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-76570 Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and writ... |
critical | 9.1 | — | Joomcode / jc tables | 2026-09-30 | 2026-10-06 |
| CVE-2026-88424 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the f... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-106037 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105691 Penpot is an open-source design and prototyping platform. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105080 In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, an... |
critical | 9.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTRO... |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injecti... |
critical | 10.0 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in B... |
critical | 9.4 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-16346 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-10-06 |
| CVE-2026-84075 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84073 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84064 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82832 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.6 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82340 IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure dese... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-103630 Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-37719 An issue in dormakaba evolo Service (all versions) allows a remote attacker to e... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105793 Microsoft UFO is an open-source framework for intelligent automation across devi... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2023-54405 H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82041 UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-88395 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbis... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.