October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,528
Critical
3,289
High
7,924
Medium
7,616
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-81657 IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-86246 Initialization of a resource with an insecure default vulnerability in Apache To... |
critical | 9.1 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-56662 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.6 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51922 agentscope v1.0.20 contains code injection in execute_shell_command (src/agentsc... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51898 sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.exec... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51906 In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image functio... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51915 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51886 langflow-ai langflow v1.9.3 is affected by: Code Injection. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51876 DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confi... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51881 deeptutor 1.4.0 contains code injection in ExecTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-53953 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-104846 Seroval facilitates JS value stringification, including complex structures beyon... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103109 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.4 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103110 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-105637 Plane is an open-source project management tool. |
critical | 9.6 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92075 Mitigation bypass in the Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-51911 vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_fig... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51918 FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51893 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mi... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51897 RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluat... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51904 SuperAGI up to v0.0.14 contains an improper access control vulnerability in the... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51879 deeptutor 1.4.0 contains an authorization bypass through a user-controlled objec... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51883 The knowledge base creation and document upload interfaces in Langchain-Chatchat... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51884 The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langc... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-105638 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105640 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104056 Authlib version 1.7.2 and below contains a vulnerability where discovery JSON me... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-92079 Mitigation bypass in the Widget: Win32 component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92057 Mitigation bypass in the Enterprise Policies component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component. |
critical | 9.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92066 Sandbox escape in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-86930 An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an att... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-86934 An authorization bypass vulnerability in the FileMaker Server Web Publishing Eng... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-92609 Session fixation in HTTP management authentication allows remote attackers to ga... |
critical | 9.8 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.