October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. |
high | 7.2 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107826 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. |
high | 8.0 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-75347 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired poi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108159 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108160 AstronRPA through 1.1.6 contains a download of code without integrity check vuln... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-55797 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108157 Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vu... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. |
high | 8.5 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2025-61560 A race condition vulnerability in the SessionManager of CNCF: Cloud Native Compu... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-26 |
| CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75345 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-75346 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and mast... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75348 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and mast... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75349 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bound... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107813 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerab... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107807 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107809 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107810 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107811 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107812 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-104084 SmarterMail before build 9777 contains a privilege escalation vulnerability wher... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-104082 SmarterMail before build 9777 contains a remote code execution vulnerability tha... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-78795 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-33367 SNMP can be used to perform administrative actions such as retrieving configurat... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-39453 Navigating to a certain URL on the switch’s web server causes the switch to rebo... |
high | 8.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-39460 Usernames and passwords, including the default factory credentials, are stored i... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-28745 Usernames and passwords, including the default credentials, are stored in the co... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-29797 No authentication is required when updating firmware or bootloader, making it ea... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108106 Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108108 PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107806 Nginx UI is a web user interface for the Nginx web server. |
high | 7.2 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-108101 HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.