October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109522 A vulnerability has been found in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109523 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108184 Improper certificate validation in certain Zoom Clients for Windows may allow an... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108185 Improper certificate validation in the My Notes feature of certain Zoom Clients... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-93907 IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to b... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-95680 IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attac... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-74045 Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74034 Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgra... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74035 Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74036 Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability wh... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users wit... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch betwe... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109965 Serena before 2.0.0 contains an improper link resolution vulnerability that allo... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109967 yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that all... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109676 FreeRDP from 3.0.0-beta1 before 3.32.0 contains a use-after-free vulnerability i... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109519 A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109520 A flaw has been found in Colorful iGameCenter 2.0.0.82. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-103499 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM We... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65164 NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort ar... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65170 NVIDIA AIStore for Linux contains a vulnerability in the experimental HT backend... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65172 NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnera... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65180 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attac... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65141 NVIDIA Isaac Lab contains a vulnerability where an attacker could cause an eval... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65147 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-65148 NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65149 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-65150 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-65161 NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an un... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65101 NVIDIA AIStore for Linux contains a vulnerability in the distributed sort compon... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65103 NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-s... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65104 NVIDIA Megatron-LM for all platforms contains a vulnerability in inference, wher... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65110 NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an atta... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109782 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109783 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109778 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109762 Incorrect boundary conditions in the SVG component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109766 Mitigation bypass in the Enterprise Policies component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.