October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109396 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vuln... |
medium | 4.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109194 A flaw was found in Red Hat Quay. |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109392 Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109393 QloApps through 1.7.0 contains an insecure direct object reference vulnerability... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108897 A security vulnerability has been detected in Smart Media4U Technology SHAREit A... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103527 Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103528 Thelia 2.6.0 uses Smarty for email templates without properly restricting access... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103529 Thelia v2.6.0 permits authenticated administrators to upload and install modules... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103537 Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty tem... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103523 Thelia v2.6.0 contains an open redirect vulnerability in its address creation wo... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103524 Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the ad... |
medium | 4.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109204 LogicalDOC Community Edition through 9.3 contains an improper authorization vuln... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109206 LogicalDOC Community Edition through 9.3 contains a username enumeration vulnera... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109169 LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109170 LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109200 LogicalDOC Community Edition through 9.3 contains a server-side request forgery... |
medium | 6.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109202 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109203 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108890 A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0... |
medium | 6.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93693 In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper valid... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-93694 In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of... |
medium | 4.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109187 jshERP through 3.6 contains an information disclosure vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109188 jshERP through 3.6 contains a missing authorization vulnerability that allows lo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109181 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109182 jshERP through 3.6 contains an incorrect authorization vulnerability in GET /sup... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109183 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109184 jshERP through 3.6 contains an improper authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109174 MoguBlog through 6.2 contains an information disclosure vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109175 MoguBlog through 6.2 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109176 MoguBlog through 6.2 contains an insecure direct object reference vulnerability... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109177 MoguBlog through 6.2 contains a broken access control vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109178 jshERP through 3.6 contains a missing authorization vulnerability in LogControll... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109179 jshERP through 3.6 contains a missing authorization vulnerability in LogControll... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109180 jshERP through 3.6 contains an authorization bypass vulnerability that allows au... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109166 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109167 TDuck survey form through 6.0 contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109168 lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerabi... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109171 yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109172 yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109173 yshop-crm through 2.1.3 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.