October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108916 A vulnerability was found in Edimax BR-6208AC 1.32. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transpor... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85975 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85965 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85966 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85968 Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85969 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85970 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85972 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85958 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85959 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85960 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85961 On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85962 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85964 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in t... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75888 A flaw was found in the OpenShift console. |
high | 7.7 | — | — | 2026-10-12 | 2026-10-30 |
| CVE-2026-85957 Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in t... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109372 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypa... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109357 LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109359 Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109360 MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that all... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109361 MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in n... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109363 ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109353 LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unpri... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109346 better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109347 Adminer before 6.1.1 contains a remote code execution vulnerability that allows... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109341 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109343 SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE stat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109334 SurrealDB before 3.3.0 does not check the caller-selected namespace or database... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109326 Grav before 2.1.7 contains an information disclosure vulnerability because bundl... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109331 Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerab... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109325 Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109313 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109314 Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.