October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability |
critical | 9.8 | Listed | BeyondTrust / Remote Support | 2026-10-15 | 2026-10-17 |
| CVE-2026-57496 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55240 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-111235 An authorization bypass vulnerability exists in the REST API of multiple version... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109829 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109383 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-102946 joserfc is a Python library that provides an implementation of several JSON Obje... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-84731 An unauthenticated remote attacker can bypass authentication and gain full acces... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph data import component in... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-57155 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110958 A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111094 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-47168 EspoCRM is an open source customer relationship management application. |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-110957 A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Inject... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved:
ipv4: valid... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-98432 In the Linux kernel, the following vulnerability has been resolved:
ipv4: free... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-24 |
| CVE-2026-109698 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109892 Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109686 Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109688 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109694 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108497 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109145 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a de... |
critical | 9.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocat... |
critical | 9.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-108587 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110911 Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted valu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110862 Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vu... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55680 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55683 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55684 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-85714 Stirling-PDF is a locally hosted web application that facilitates various operat... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110536 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55573 e107 is a content management system (CMS). |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55572 e107 is a content management system (CMS). |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108390 Hestia Control Panel is a lightweight and powerful control panel for the modern... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101982 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101983 A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.