October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105209 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorizati... |
critical | 9.6 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105215 ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in... |
critical | 9.1 | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105207 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user... |
critical | 9.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103355 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability |
critical | 10.0 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-105135 A vulnerability has been found in InternLM MindSearch 0.1.0. |
critical | 10.0 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105105 CWE-306: Missing Authentication for Critical Function in the ait.core.server tel... |
critical | 9.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92084 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-87115 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105080 In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, an... |
critical | 9.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-84411 The web management service in affected RouterOS versions contains an integer und... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-95102 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82041 UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82042 UTMStack before 11.2.16 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon Sag... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103956 Missing authentication for critical function in the authentication dependency in... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2023-54405 H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-102795 Improper Access Control vulnerability in Apache Traffic Server. |
critical | 9.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51922 agentscope v1.0.20 contains code injection in execute_shell_command (src/agentsc... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51904 SuperAGI up to v0.0.14 contains an improper access control vulnerability in the... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51906 In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image functio... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51911 vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_fig... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51915 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51918 FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51898 sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.exec... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104846 Seroval facilitates JS value stringification, including complex structures beyon... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103630 Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-103648 Path traversal in image-downloader 4.3.0 allows an attacker who can control the... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103626 Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103628 Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-90970 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecti... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-19652 The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104610 A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104611 A vulnerability was detected in Tenda AC9 15.03.02.13. |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94541 The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerabl... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103877 Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-07 |
| CVE-2026-97637 The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass vi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multila... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93029 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93697 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.