October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104905 FacturaScripts before version 2026.7 contains a PHP object injection vulnerabili... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-101919 A flaw was found in the HyperShift operator. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2025-15643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-14 |
| CVE-2026-105382 A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105383 A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-12171 auto-changelog before 2.6.1 merges configuration from inside the target reposito... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104970 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published... |
high | 7.3 | — | Techfry / tf content | 2026-10-05 | 2026-10-16 |
| CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-88396 ApiAdmin v5.0 and before is vulnerable to Directory Traversal. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104890 Kunstmaan CMS is an open source content management system based on the Symfony f... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104891 mppx-condition-gate provides conditional free-access wrappers for mppx payment m... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102775 Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (... |
high | 7.5 | — | Phoca / phoca cart | 2026-10-05 | 2026-10-14 |
| CVE-2026-88392 Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88394 WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-92931 CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs... |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-77805 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262... |
high | 7.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105307 A vulnerability was detected in Casdoor up to 3.161.1. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105290 A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-19185 The system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validate... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19184 The NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-sup... |
high | 8.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105253 A vulnerability was determined in itsourcecode Online Admission System Project 1... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104407 Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104408 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104389 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105247 A vulnerability was determined in SourceCodester Online Reviewer Management Syst... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105314 Papermerge 3.5.3 allows remote code execution by a standard user via directory t... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105238 A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105246 A vulnerability was found in SourceCodester Online Reviewer Management System 1.... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2019-25777 YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to repl... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105231 A vulnerability was detected in kishor-23 food-waste-management-system 411989e3e... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105232 A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105230 A security vulnerability has been detected in kishor-23 food-waste-management-sy... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105229 A weakness has been identified in kishor-23 food-waste-management-system 411989e... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105185 A vulnerability was detected in itsourcecode Online Admission System 1.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105182 A security flaw has been discovered in SourceCodester Online Reviewer Management... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105183 A weakness has been identified in itsourcecode Online Admission System 1.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105184 A security vulnerability has been detected in itsourcecode Online Admission Syst... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-20586 In vdec, there is a possible out of bounds write due to a missing bounds check. |
high | 8.8 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-30 |
| CVE-2026-20524 In apu, there is a possible memory corruption due to improper input validation. |
high | 8.4 | — | Mediatek / mt6899 firmware | 2026-10-05 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.