October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78673 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84313 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-84315 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-53997 Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109567 Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management v... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109568 Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in t... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109569 sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass t... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109560 Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vuln... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109563 N3.js before 2.11.1 contains a regular expression denial of service vulnerabilit... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109426 Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109556 EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnera... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109557 EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerabil... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105052 IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2021-48012 fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerabilit... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2020-37280 cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.dec... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2021-48011 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-95837 containerd is an open-source container runtime. |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41510 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109422 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109423 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57143 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59976 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59977 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65954 PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-83535 A flaw was found in openstack-network-exporter. |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108921 A vulnerability was detected in KusalkaSilva Learning-Management-System up to ff... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18166 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105464 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105465 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-77363 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108479 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108481 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.