October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109602 Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scri... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108937 A vulnerability was detected in code-projects Online Ticket Reservation System 1... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108938 A flaw has been found in code-projects Matrimonial System 1.0. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109574 Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that al... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109595 Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that a... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2025-71431 Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnera... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2024-58391 Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vul... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2025-71430 Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scri... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2023-54407 Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2023-54408 Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnera... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2023-54409 Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vu... |
medium | 4.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2023-54410 Frappe before 13.22.0 contains an improper authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2023-54411 Frappe framework before 13.32.0 uses weak authentication for print view access,... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2023-54412 Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access contro... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2023-54406 Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the f... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-53922 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-54459 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103658 GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-base... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104140 QGIS is a free, open source, cross-platform geographic information system. |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108932 A vulnerability was determined in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-41210 Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102596 Nango is an open-source platform for connecting agents and products to third-par... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-97691 Convex is an open-source reactive database for application developers. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-84320 Nginx UI is a web user interface for the Nginx web server. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84321 Nginx UI is a web user interface for the Nginx web server. |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-41504 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41508 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-18533 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-16678 IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120... |
medium | 4.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109565 Rapyd Admin from 9.4.0 before 9.20.0 contains a stored cross-site scripting vuln... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109570 Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authenti... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109571 Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authenti... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109561 goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability t... |
medium | 4.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability t... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109379 Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109427 Telegram-Stremio through 5.1.0 contains a broken object-level authorization vuln... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109375 Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109376 ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerabilit... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109377 ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability tha... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109378 SPIP before 4.4.18 contains a server-side request forgery vulnerability in recup... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.