October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109659 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109648 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109649 Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109650 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109651 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side re... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109643 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109644 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109645 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109646 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109647 Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109637 Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability tha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109638 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109639 Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109641 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109642 Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109632 Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109634 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109635 Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109636 Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109626 Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109627 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109628 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109629 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109630 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109631 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109621 Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109622 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109623 Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing author... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109624 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109625 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109614 Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability tha... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109615 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109609 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109610 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing author... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109611 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerab... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109597 Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnera... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109598 Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing auth... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109599 Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109600 Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.