October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109201 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93695 In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyServic... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109186 jshERP through 3.6 contains a mass assignment vulnerability in the UserControlle... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-52903 A deserialization of untrusted data vulnerability was found in ManageIQ. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109185 jshERP through 3.6 contains a missing authorization vulnerability in the UserCon... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108953 mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that a... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109164 TDuck survey form through 6.0 contains an insecure direct object reference vulne... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-108836 A vulnerability has been found in Ollama up to 0.34.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105410 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105411 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105412 An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could al... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108826 A vulnerability was found in Zen Cart up to 2.2.2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103903 An incorrect authorization vulnerability in the WinBox
authentication flow of Mi... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105407 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105408 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105409 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103902 Improper verification of cryptographic signature vulnerability in DigiDoc libdig... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108819 A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108818 A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-78355 A path traversal vulnerability in the OTRS SendSupportBundle functionality allow... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108807 A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d2... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-98385 In the Linux kernel, the following vulnerability has been resolved:
sched/cache... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2026-108805 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108806 A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-87690 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is a... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108799 A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d1... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108798 A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108985 ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108980 Blinko through 1.8.8 allows directory traversal, overwriting startup files as ro... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108783 A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain c... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-19935 The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) da... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's lin... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19669 The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_ga... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19736 The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed t... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108913 omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-pa... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108902 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulne... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108905 pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key v... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108863 Katanemo Plano through 0.4.37 contains a missing authentication vulnerability th... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.