October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20526 In Modem, there is a possible out of bounds write due to a missing bounds check. |
high | 7.5 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20531 In apu, there is a possible memory corruption due to use after free. |
high | 8.4 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-09 |
| CVE-2026-20519 In Modem, there is a possible out of bounds write due to a missing bounds check. |
high | 7.5 | — | Mediatek / mt6833 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20520 In Modem, there is a possible out of bounds write due to a missing bounds check. |
high | 7.5 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20521 In Video HAL, there is a possible escalation of privilege due to a missing bound... |
high | 8.4 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20522 In neuropilot, there is a possible out of bounds write due to a missing bounds c... |
high | 8.4 | — | Mediatek / mt6881 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20523 In neuropilot, there is a possible out of bounds write due to a missing bounds c... |
high | 8.4 | — | Mediatek / mt6881 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-105295 GitAhead 2.5.0 through 2.7.1 contains an insecure update mechanism that installs... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105175 A vulnerability was found in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105223 maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verificat... |
high | 7.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105293 Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105294 Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability tha... |
high | 7.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105172 A vulnerability was detected in itsourcecode Online Admission System 1.0. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105169 A security flaw has been discovered in kishor-23 food-waste-management-system 41... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105170 A weakness has been identified in kishor-23 food-waste-management-system 411989e... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105166 A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb8... |
high | 7.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105167 A vulnerability was determined in kishor-23 food-waste-management-system 411989e... |
high | 7.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105220 Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in... |
high | 7.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105221 The gist RubyGem before 6.1.0 contains an improper certificate validation vulner... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105222 The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certifi... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105216 go-micro before 6.0.0 contains an improper certificate validation vulnerability... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105218 gopay before 1.5.119 disables TLS certificate verification in defaultClient() in... |
high | 7.4 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105219 Mammoth.js 1.3.0 before 1.12.3 contains a regular expression denial of service v... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105086 WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerabi... |
high | 8.7 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105089 WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability... |
high | 8.7 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105210 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio... |
high | 8.2 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105211 ZITADEL before 4.17.1 contains an authentication bypass vulnerability in Login V... |
high | 8.1 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105212 ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypas... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105213 ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during... |
high | 8.2 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105158 A vulnerability was detected in RainyGao DocSys up to 2.02.85. |
high | 7.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105208 ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with... |
high | 7.7 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105148 A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. |
high | 7.3 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105149 A security flaw has been discovered in mooSocial up to 3.2.4. |
high | 7.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105147 A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. |
high | 7.3 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-97307 Insertion of Sensitive Information Into Sent Data vulnerability in StylemixTheme... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-97276 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103344 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103354 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103062 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-93549 The CoCart WordPress plugin before 4.9.7 does not scope its REST API authenticat... |
high | 8.8 | — | — | 2026-10-04 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.