October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63157 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63168 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63169 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 6.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-14532 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-14909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-19810 Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be s... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11713 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-107369 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origi... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107370 When a username for an Active Directory connection is a domain without a local p... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107371 When the authorize() method is called with a maxAge parameter, the auth0.js libr... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105896 Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that c... |
medium | 5.5 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-104587 blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103828 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103829 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103822 Substance3D - Designer is affected by an out-of-bounds read vulnerability that c... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103823 Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerabilit... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103824 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103825 Substance3D - Designer is affected by an out-of-bounds read vulnerability that c... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103826 Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability t... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-103827 Substance3D - Designer is affected by a Stack-based Buffer Overflow vulnerabilit... |
medium | 5.5 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-100130 Substance3D - Sampler is affected by an out-of-bounds read vulnerability that co... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100131 Substance3D - Sampler is affected by an out-of-bounds read vulnerability that co... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100126 Bridge is affected by an out-of-bounds read vulnerability that could lead to dis... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-83958 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-83960 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-63147 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63148 Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vu... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-48398 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-56826 Shopper is a Headless e-commerce Admin Panel. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110074 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110075 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110076 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110077 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110078 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110079 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110080 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-110081 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-110082 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-109415 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-110037 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.