October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75061 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse di... |
high | 7.5 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-75095 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-19627 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitr... |
high | 8.2 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-17475 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 7.1 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-19620 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauth... |
high | 8.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-109673 Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege esca... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109671 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side te... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-s... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109612 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109613 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109616 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109604 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109608 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerabilit... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109573 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escap... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2025-71432 Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-102627 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2024-58390 Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege man... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-27 |
| CVE-2026-84312 Nginx UI is a web user interface for the Nginx web server. |
high | 7.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-90911 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90912 IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cau... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90921 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-92876 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96264 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96265 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96266 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96261 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96262 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96263 IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84316 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84317 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84318 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84319 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84360 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75881 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.