October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106100 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105860 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105861 Payload is a free and open source headless content management system. |
high | 8.2 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105862 Payload is a free and open source headless content management system. |
high | 8.7 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105865 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105866 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105854 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105855 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105856 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105858 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105849 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105850 Payload is a free and open source headless content management system. |
high | 8.2 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105851 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105852 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol ser... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-76105 Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of In... |
high | 7.1 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-63690 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67270 Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Impro... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-61411 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertio... |
high | 7.7 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-26287 External Secrets Operator reads information from a third-party service and autom... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-54472 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of H... |
high | 7.5 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-105796 Kiota is an OpenAPI based HTTP Client code generator. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105797 SimpleChat is a secure AI conversation application with personal and group works... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105798 SimpleChat is a secure AI conversation application with personal and group works... |
high | 8.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105791 Microsoft UFO is an open-source framework for intelligent automation across devi... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-104069 HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModu... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-85523 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106040 Mooncake Store master through 0.3.13.post1 contains a missing authorization vuln... |
high | 8.2 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106038 Mooncake Store master through 0.3.13.post1 contains a missing authentication vul... |
high | 8.2 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105839 libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105840 lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive u... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105841 lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz re... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105920 A vulnerability was determined in Kusalkasilva Learning-Management-System up to... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105788 Microsoft UFO is an open-source framework for intelligent automation across devi... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105837 libmikmod before 3.3.14 contains an integer overflow vulnerability in DSM_Load()... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-82531 Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105919 A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb8... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST... |
high | 7.4 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105918 A vulnerability has been found in Kusalkasilva Learning-Management-System up to... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105985 Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.