October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,478
Critical
1,340
High
5,869
Medium
6,255
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108927 A weakness has been identified in itsourcecode Baptism Information Management Sy... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108928 A security vulnerability has been detected in itsourcecode Online Admission Syst... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108931 A vulnerability was found in Netcore NR268 1.7.121109. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-106495 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2022-51020 Flower before 2.2.0 contains a cross-site request forgery vulnerability because... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2024-58389 HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-27 |
| CVE-2026-109424 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109425 Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnera... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108923 A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108924 A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108926 A security flaw has been discovered in itsourcecode Baptism Information Manageme... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104332 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104774 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2025-27896 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27897 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27902 IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link wit... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27895 IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2026-85471 A flaw was found in Quay. |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-78404 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a loca... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-83536 A flaw was found in openstack-network-exporter. |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108919 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108920 A security vulnerability has been detected in SourceCodester Drug Recommendation... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108922 A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105466 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a deni... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102663 OpenList is a file list program that supports multiple storage backends. |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-61994 Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows E... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-77364 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109448 Integer wraparound in psqlODBC SQLBindParameter allows an application, or an att... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108482 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108486 Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exp... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103080 External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-107418 Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploi... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-107862 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-85976 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-94451 Quarkus REST Data Panache provides a way to automatically generate REST endpoint... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-85967 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OID... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109364 Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows una... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109362 Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.