October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104106 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104107 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55679 WeGIA is a web manager for charitable institutions. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-55498 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55385 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110669 A security vulnerability has been detected in cemtan sar2html 4.0.0. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110310 A remote user who can read encrypted objects in the S3 bucket can force a paddin... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102980 Plane is an open-source project management tool. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102985 Plane is an open-source project management tool. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-55167 LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. |
medium | 4.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110771 Shopizer through 3.2.5 contains an authorization bypass vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110772 Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110773 GrowChief through 0.3.0 contains a missing authorization vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110774 Blinko through 1.8.8 contains a broken access control vulnerability in the /api/... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110775 Nexent through 2.7.0 contains a missing authorization vulnerability in check_fil... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110763 lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110764 AstronRPA through 1.1.6 contains an insecure direct object reference vulnerabili... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110765 FlexPrice through 2.1.38 contains an authentication bypass vulnerability in Hand... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110766 Colanode server through 0.4.7 contains a path traversal vulnerability that allow... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110768 holaOS through 2026.822.1 contains an authorization bypass vulnerability in the... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110666 A vulnerability was identified in cemtan sar2html 4.0.0. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110248 Insertion of sensitive information into log files in the git_utils[.]py componen... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103974 lichess.org is the forever free, adless and open source chess server. |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102460 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-14 | 2026-10-20 |
| CVE-2026-102471 In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-14 | 2026-10-20 |
| CVE-2026-102479 In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], th... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-14 | 2026-10-28 |
| CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and mult... |
medium | 5.6 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-102354 BentoPDF is a privacy-focused PDF toolkit that runs in the browser. |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92157 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-92159 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92160 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92156 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86847 A flaw was found in DPDK lib/vhost vhost-crypto. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-86849 A flaw was found in DPDK lib/vhost vhost-crypto. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86856 A flaw was found in the DPDK nfp vDPA driver. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86566 A flaw was found in DPDK lib/vhost. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86845 A flaw was found in DPDK lib/vhost vhost-crypto. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86846 A flaw was found in DPDK lib/vhost vhost-crypto. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110777 A flaw was found in evolution-data-server. |
medium | 5.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108151 Improper Control of Generation of Code ('Code Injection') vulnerability in Plugi... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.