October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,546
Critical
3,291
High
7,931
Medium
7,625
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93697 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multila... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103764 Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102795 Improper Access Control vulnerability in Apache Traffic Server. |
critical | 9.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-89134 A certificate with no dNSName SAN but another SAN type present (e.g. |
critical | 9.1 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-55083 DHIS2 is a flexible information system for data capture, management, validation,... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-93029 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103922 Capacitor is a cross-platform native runtime for web applications. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-90970 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecti... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-77987 A server-side request forgery (SSRF) vulnerability was identified in the noteboo... |
critical | 9.8 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
| CVE-2026-94541 The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerabl... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-79687 Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vu... |
critical | 10.0 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-55176 Soft Machine is a Virtual Machine–based agentic development environment / Cloud... |
critical | 9.0 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-100273 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts de... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100277 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by repla... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-93985 OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in th... |
critical | 9.9 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2010-2861 Adobe ColdFusion Directory Traversal Vulnerability |
critical | 9.8 | Listed | Adobe / ColdFusion | 2010-08-11 | 2026-10-02 |
| CVE-2018-7602 Drupal Core Remote Code Execution Vulnerability |
critical | 9.8 | Listed | Drupal / Core | 2018-07-19 | 2026-10-02 |
| CVE-2020-12812 Fortinet FortiOS SSL VPN Improper Authentication Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiOS | 2020-07-24 | 2026-10-02 |
| CVE-2026-104610 A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104611 A vulnerability was detected in Tenda AC9 15.03.02.13. |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-84436 IBM Guardium Data Protection 12.2 is vulnerable to command injection in the cert... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-02 |
| CVE-2026-53988 Dockhand before 1.0.40 contains an authentication bypass vulnerability in its gi... |
critical | 10.0 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-51872 Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51867 agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/ap... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51861 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/bac... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51857 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can ru... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102792 A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2018-19949 QNAP NAS File Station Command Injection Vulnerability |
critical | 9.8 | Listed | QNAP / Network Attached Storage (NAS) | 2020-10-28 | 2026-10-02 |
| CVE-2024-13994 Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control w... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-13996 Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessi... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-13999 Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose th... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-14003 Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RC... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2019-2725 Oracle WebLogic Server, Injection |
critical | 9.8 | Listed | Oracle / WebLogic Server | 2019-04-26 | 2026-10-01 |
| CVE-2018-19323 GIGABYTE Multiple Products Privilege Escalation Vulnerability |
critical | 9.8 | Listed | GIGABYTE / Multiple Products | 2018-12-21 | 2026-10-01 |
| CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver. |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer ove... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103752 Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62071 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56660 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.