October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76975 Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-76976 Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108943 A weakness has been identified in ModelTC LightX2V up to 0.5.0. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108944 A security vulnerability has been detected in repository RAE up to a4d18c4db7664... |
medium | 4.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108945 A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-17487 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user pro... |
medium | 5.3 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-18318 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-forc... |
medium | 5.3 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-18343 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP ta... |
medium | 4.4 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-19936 The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh... |
medium | 4.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-19937 The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/... |
medium | 5.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-19938 The Bluetooth host's ATT transmit path releases a buffer it does not own when si... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-93886 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to exec... |
medium | 5.4 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-108939 A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108940 A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108941 A vulnerability was identified in Linketic CityGaussian up to 2.0. |
medium | 4.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-17484 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of s... |
medium | 5.5 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-92832 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
medium | 5.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-82103 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
medium | 6.5 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-75063 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
medium | 5.4 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-75076 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75621 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
medium | 6.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18541 IBM Planning Analytics 2.0, and 2.1 is vulnerable to stored cross-site scripting... |
medium | 5.4 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-109672 Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109674 Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection v... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109675 Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a b... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109666 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109668 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109669 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109670 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-s... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109660 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints tha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109661 Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109662 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109663 Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109664 Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability th... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109665 Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109654 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109655 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109656 Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109657 Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulner... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109658 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.