October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109317 Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability th... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates'... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109312 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in proces... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109305 Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109290 Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vuln... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109291 Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerabili... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109286 Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vul... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109257 FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-109242 FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory f... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109237 Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-85949 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-85950 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85951 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85952 Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85953 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85954 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109398 Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109399 SWUpdate through 2026.05.1 contains an improper certificate validation vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109391 Square Squash through commit e73f280 contains an insecure deserialization vulner... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109394 Thirty bees through 1.7.0 contains an authentication bypass vulnerability in Pas... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-107248 Thelia 3.0.0's back-office Email/Messages feature contains a server‑side templat... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108899 A flaw has been found in tobychui zoraxy up to 3.3.4. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108900 A vulnerability has been found in Exponent CMS up to 3.0.2patch2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108906 A vulnerability has been found in Netcore NR268 1.7.121109. |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108094 A use-after-free flaw was found in mutter in the Wayland color-management ICC im... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of exe... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109228 SGLang through 0.5.21 contains a resource budget bypass vulnerability that allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109229 SGLang through 0.5.21 contains a denial of service vulnerability that disables P... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-12613 Deserialization of untrusted data vulnerability in Ministry of Justice General D... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18390 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109205 LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109225 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in lo... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109227 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in p... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109199 LogicalDOC Community Edition through 9.3 contains a code injection vulnerability... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.