October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11930 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-107781 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107782 System Informer before 4.0.26241.138 contains an incorrect authorization vulnera... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-11318 Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-101024 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal v... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107318 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HT... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-84275 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM fil... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84245 IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84250 IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protec... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84271 IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypa... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-107707 Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerabi... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107390 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-14 |
| CVE-2026-107391 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107392 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit... |
high | 8.2 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-84276 IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerabi... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84278 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 7.2 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-40804 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107701 dot-access through 1.0.0 contains a prototype pollution vulnerability that allow... |
high | 8.2 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107385 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107384 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106433 Improper state management in MongoDB libmongocrypt can cause provider-specific d... |
high | 8.8 | — | Mongodb / libmongocrypt | 2026-10-08 | 2026-10-27 |
| CVE-2026-106437 The BSON buffer-reservation API in the MongoDB C Driver can record a length smal... |
high | 7.4 | — | Mongodb / c driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-107322 An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS database... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107376 webonyx graphql-php is a PHP implementation of the GraphQL specification. |
high | 8.2 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107377 datamodel-code-generator generates Python data models from schema definitions. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina/file... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107375 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/ |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107302 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-107303 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 7.6 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsiste... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107300 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107709 A path traversal vulnerability exists in Bower decompress-zip through version 0.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107295 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.6 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-105436 Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-ch... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability th... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bun... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.