October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89269 The WP Testimonials WordPress plugin through 1.4.13 does not properly escape tes... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-54869 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-54868 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-54867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108962 A vulnerability has been found in storyicon comfyui_segment_anything up to ab639... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108961 A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108957 A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108958 A weakness has been identified in TensorLayer up to 2.2.4. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108959 A security vulnerability has been detected in itsourcecode Online Cake Ordering... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108960 A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3b... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-84284 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-22 |
| CVE-2026-85529 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-92528 GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 be... |
medium | 4.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-9268 GitLab has remediated an issue in GitLab EE affecting all versions from 13.6 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-5954 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1... |
medium | 4.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-6567 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-78335 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
medium | 4.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-16 |
| CVE-2026-7767 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11... |
medium | 5.8 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-14210 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.11... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-14552 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-16275 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-108947 A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108948 A vulnerability has been found in code-projects Online Reviewer System 1.0. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108954 A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108955 A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-101168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0... |
medium | 6.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-104661 GitLab has remediated an issue in GitLab EE affecting all versions from 17.0 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-105458 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-100755 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2... |
medium | 4.6 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-89122 SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certai... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89124 Display Product Catalog Based on Customs Declaration application does not perfor... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89112 The admin API endpoint used to retrieve CLA signature records does not consisten... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89116 The affected code used child_process.execSync with a shell string for generator... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89117 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject mal... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89118 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access res... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89121 SAP S/4HANA does not perform sufficient instance-level authorization checks for... |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89105 The HybridTokenAuthenticator component of the SAP/cloud-security-services-integr... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89106 SAP UI5 does not perform sufficient input validation under certain configuration... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-76972 Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integrati... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.