October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105761 Dify is an open-source LLM app development platform. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105759 vLLM is an inference and serving engine for large language models. |
high | 7.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-16 |
| CVE-2026-105469 A vulnerability was determined in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105470 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties... |
high | 7.5 | Listed | Atlassian / Multiple Products | 2026-10-05 | 2026-10-29 |
| CVE-2026-105750 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105751 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-16 |
| CVE-2026-105744 Docling simplifies document processing by parsing diverse formats and providing... |
high | 8.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105745 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105468 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-77226 Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105773 Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalat... |
high | 7.0 | — | — | 2026-10-05 | 2026-10-26 |
| CVE-2026-105741 Langflow is a tool for building and deploying AI-powered agents and workflows. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102262 Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-95263 Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95265 Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in t... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97257 Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Plan... |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93617 Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Ca... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78860 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78861 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105679 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105651 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105675 Ghost is a Node.js content management system. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105677 Ghost is a Node.js content management system. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105649 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105650 Ghost is a Node.js content management system. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105392 A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103066 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103348 Deserialization of Untrusted Data vulnerability in Smackcoders Inc. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100511 Deserialization of Untrusted Data vulnerability in Vektor Inc. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100506 Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97303 Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Co... |
high | 7.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-58859 In multiple places, there is a possible denial of service due to an uncaught exc... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58865 In multiple functions of PduParser.java, there is a possible persistent denial o... |
high | 7.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58880 In handle_app_val_response of btif_rc.cc, there is a possible way to achieve cod... |
high | 7.0 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55270 In dialInternal in multiple locations, there is a possible permission bypass due... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55280 In multiple locations, there is a possible out-of-bounds write due to uninitiali... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55286 In stpropnci_process of stpropnci.cc, there is a possible out of bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58815 In multiple locations, there is a possible out of bounds write due to an incorre... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58835 In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.