October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,872
Medium
6,263
Low
649
Severity not reported
3,355
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96297 Use of freed memory in the aggregation feature of MongoDB Server can cause the s... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-96299 A security issue was discovered in MongoDB mongos (the sharded cluster router) w... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-79611 For XSA-308 logic was introduced, as VMX VMEntry checks do not like the
exact co... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-81507 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79607 During Xenstore live update the state record for a Xenstore watch with
specified... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-49264 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109524 A vulnerability was determined in girishsaraf Online-Appointment-Booking-System... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-104005 A security issue was discovered in MongoDB mongos (the sharded cluster router) w... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105460 A flaw was found in BlueZ. |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102981 Plane is an open-source project management tool. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102988 Plane is an open-source project management tool. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103965 An issue in MongoDB Server's aggregation framework can cause certain constant va... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-104004 MongoDB Server's collection validation feature may not properly handle certain e... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102672 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102700 With its original introduction, GNTTAB_cache_flush was made available
uniformly. |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102734 asteval is a Python expression evaluator designed for restricted execution. |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102832 JupyterLab is an extensible environment for interactive and reproducible computi... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2024-34321 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-34326 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-9218 Insufficient input validation vulnerability in time server (NTP) setting of the... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77375 SFTPGo is an open source, event-driven file transfer solution. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65199 openUBMC assigns the full privilege set to pseudo-identities representing SNMP c... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11730 Insufficient session randomness vulnerability in the listed NETGEAR Extender mod... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-107917 Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEA... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-107918 Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR... |
medium | 4.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102342 ammonia is a Rust library for repairing and securing untrusted HTML. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103028 SFTPGo is an open source, event-driven file transfer solution. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2024-34319 A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix L... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-28 |
| CVE-2026-93346 Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-93347 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the ge... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77361 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77362 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-74047 Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-74030 Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vul... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74031 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the de... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74032 Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability th... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-74033 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the ge... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109966 yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that al... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109959 EspoCRM 4.0.0 before 10.0.7 contains an access control vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.