October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94593 Armatura One's backup and restore routine records the full database connection c... |
high | 7.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-97212 The WebSocket backend uses charging station identifiers to uniquely associate se... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-97363 The WebSocket Application Programming Interface lacks restrictions on the number... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82044 UTMStack before 11.2.16 contains a server-side request forgery vulnerability tha... |
high | 7.7 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82039 UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupS... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-39718 Cross-Site Request Forgery (CSRF) vulnerability in Webriti Wallstreet wallstreet... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104988 A flaw was found in Dogtag PKI (pki-core). |
high | 8.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104991 Phproject before 1.8.7 contains a missing object-level authorization vulnerabili... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker t... |
high | 8.8 | — | Microsoft / exchange server | 2026-10-02 | 2026-10-15 |
| CVE-2026-103958 Server-side request forgery in the tool server and remote agent connection handl... |
high | 7.6 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2020-37278 Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability th... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2014-125130 CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress t... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-59265 A code execution issue in the Java integration in Apache OpenOffice v4.1.16 and... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-08 |
| CVE-2026-104861 probe-image-size gets image dimensions without downloading the entire file. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem int... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-67989 crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a pol... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51907 In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function,... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51914 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51916 TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnera... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51917 FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code. |
high | 7.3 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51901 SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. |
high | 8.1 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104845 Seroval facilitates JS value stringification, including complex structures beyon... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103631 Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-103622 Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103623 Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-103624 Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0... |
high | 8.3 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103625 Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-101104 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization f... |
high | 7.7 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104637 A weakness has been identified in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104026 In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to... |
high | 7.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94422 An incorrect implementation of message filtering in xdg-dbus-proxy versions befo... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-24 |
| CVE-2026-85215 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-16 |
| CVE-2026-93875 The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104471 YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that all... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104472 YesWiki before 4.6.7 contains a missing authorization vulnerability in the attac... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104609 A weakness has been identified in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104467 YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiServic... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104460 YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newte... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104462 YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuaget... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104463 YesWiki before 4.6.7 contains a server-side request forgery vulnerability that a... |
high | 7.0 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.