October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108978 Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Bu... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108925 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
medium | 6.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108768 A vulnerability was identified in zhayujie CowAgent up to 2.2.0. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-19738 The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected I... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19739 The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/l... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19740 The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bl... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-59508 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
medium | 5.9 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19576 The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch poi... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19735 The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c deriv... |
medium | 4.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19737 i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested dir... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108888 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108891 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108903 pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulne... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108904 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclos... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108880 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PU... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108881 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ge... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108882 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108883 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ed... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108884 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108885 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108886 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108887 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108873 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108874 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108875 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108876 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the pu... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108877 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragP... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108878 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108879 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108866 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108867 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108868 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108869 JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allo... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108870 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108871 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108872 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the ba... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108682 A weakness has been identified in zhayujie CowAgent up to 2.1.6. |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108683 A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108684 A vulnerability was detected in erzhongxmu Jeewms up to 3.7. |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108861 Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability th... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.