October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100133 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-92892 Potential arbitrary code execution under specific configurations. |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-52394 DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-37107 An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via th... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal')... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-21 |
| CVE-2026-94603 Podman is a tool for managing OCI containers and pods. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78799 Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing)... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69227 A flaw in Portal for ArcGIS allows unauthenticated access to
certain Portal Ad... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55562 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54454 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-55183 RClone Manager is a cross-platform GUI application designed to help users manage... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110116 Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversa... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction befor... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102989 TanStack Router is a client-first, server-capable, fully type-safe router and fu... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79608 The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to bet... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-55695 FearlessCMS is a flat-file content management system centered on simplicity and... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78802 An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55675 The Salty documentation repository builds and deploys the docs.saltbox.dev websi... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2024-34323 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-28 |
| CVE-2024-34320 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect acces... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-53709 MCP Context Forge is an MCP gateway and administrative platform. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104192 Dragonfly is an in-memory data store built for modern application workloads. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-107460 Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-74043 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74040 Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-65173 NVIDIA AIStore for Linux contains a missing authentication vulnerability in the... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65162 NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes P... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109772 Same-origin policy bypass in the DevTools component. |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109755 Sandbox escape in the DOM: Content Processes component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109740 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.