October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106172 A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-88838 A flaw was found in BusyBox's mount utility. |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-85733 FrankenPHP is a modern application server for PHP. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69226 A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-19940 The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-19939 The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in av... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110125 Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnera... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110126 waynboot-mall through 2.0.0 contains an insecure direct object reference vulnera... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110127 waynboot-mall through 2.0.0 contains an insecure direct object reference vulnera... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110129 fuintCatering through commit 122c9e6 contains an insecure direct object referenc... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110131 ThriveX-Server through 4.0 contains a missing authorization vulnerability in the... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110118 WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability th... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110120 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110121 PickMall lilishop through 4.4 contains an insecure direct object reference vulne... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110122 PickMall lilishop through 4.4 contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110109 JetLinks Community through 2.10.0 contains a missing authorization vulnerability... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110110 JetLinks Community through 2.10.0 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110113 PublicCMS through V6.202608.a contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110114 FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110117 SmartAdmin through 3.30.0 contains a missing authorization vulnerability in Admi... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110103 bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110104 Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110105 B3log Symphony through 3.6.4 contains a missing authorization vulnerability that... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110106 RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulner... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110107 RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vuln... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-10759 A flaw in Portal for ArcGIS could allow LDAP injection through administrative fu... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110098 Jorani before 1.0.4 contains an insecure direct object reference vulnerability t... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110099 Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr con... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110100 Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts:... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110101 Koillection through 1.8.4 contains a stored cross-site scripting vulnerability t... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109890 Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor pre... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109896 Missing Authorization vulnerability in WP Chill Download Monitor integration for... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109898 Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solu... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109827 A vulnerability has been found in GPAC up to 26.07.0. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109828 A vulnerability was found in libsndfile up to 1.2.2. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-106034 A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows... |
medium | 5.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106035 An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Clou... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104126 JumpServer is an open source bastion host and an operation and maintenance secur... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104250 The unstructured library provides open-source components for ingesting and pre-p... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.