October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level con... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-104048 A flaw was found in SSSD. |
high | 8.1 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-09 |
| CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalat... |
high | 7.2 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead... |
high | 8.8 | — | Elastic / kibana | 2026-10-06 | 2026-10-13 |
| CVE-2026-102160 An operating system (OS) command injection vulnerability in CloudVision CUE back... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102161 An unauthenticated attacker located on an adjacent private network (or any attac... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102162 On affected Arista Wi-Fi access points with captive portal, or application firew... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102163 On affected Arista access points with Wireless Intrusion Prevention System (WIPS... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102165 On affected Arista Wi-Fi access points, an unauthenticated attacker with network... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102167 On affected Arista Wi-Fi access points, a memory corruption vulnerability exists... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101158 A missing input validation vulnerability in the Fileserver upload API allows an... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102155 An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectral... |
high | 8.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101152 Insufficient validation in the Single Sign-On (SSO) login flow could allow a rem... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101153 On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor,... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101154 An authenticated remote attacker with specific permissions can read or write fil... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101156 A stored cross-site scripting (XSS) vulnerability may allow an authenticated, hi... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101157 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated a... |
high | 8.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101027 When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allo... |
high | 7.7 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-96890 A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Ente... |
high | 8.8 | — | Github / enterprise server | 2026-10-06 | 2026-10-09 |
| CVE-2026-83550 A flaw was found in postgres-exporter. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-86361 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-86362 Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Contr... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-63697 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate... |
high | 7.2 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-71168 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
high | 7.8 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-56906 In ep_free of eventpoll.c, there is a possible use-after-free due to a race cond... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106441 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106442 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106443 WeasyPrint helps web developers to create PDF documents. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106423 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106426 Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106440 Hydra is a framework for elegantly configuring complex applications. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106421 Use after free in PDF in Google Chrome prior to 155.0.8059.39 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106409 Incorrect reference resolution in WebAppInstalls in Google Chrome on on Mac prio... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106411 Use after free in Parser in Google Chrome prior to 155.0.8059.39 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106412 Race condition in Core in Google Chrome on on Mac prior to 155.0.8059.39 allowed... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106403 Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106393 Use after free in Storage in Google Chrome prior to 155.0.8059.39 allowed a remo... |
high | 8.3 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106383 Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106387 Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.3... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106371 Incorrect authorization in Transactions Platform in Google Chrome on on Android... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.