October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108862 APIPark through 1.9.7-beta contains an insecure direct object reference vulnerab... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108864 iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108854 Wanwu before 0.6.3 contains an insecure direct object reference vulnerability th... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108855 UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108856 UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108858 Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnera... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108698 hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability i... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108699 hyper-mcp through 0.8.3 contains an improper signature verification vulnerabilit... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108839 thClaws through 0.141.0 contains a link-following vulnerability in the post_inpu... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108850 Company Research Agent through 2.2.0 contains a server-side request forgery vuln... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108852 Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allow... |
medium | 4.7 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108681 A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108697 CoreShop through 2026.2.2 contains a missing authorization vulnerability that al... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108759 mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistra... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108752 JupyterHub through 6.0.1 contains an identifier collision vulnerability that all... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108755 Hatchet through 0.110.5 contains an allocation of resources without limits vulne... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108756 Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability i... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108757 Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authent... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108747 Lightdash through 2.556.0 contains an authorization bypass vulnerability that al... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vu... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108750 OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108751 MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the... |
medium | 4.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108737 Traccar through 6.16.0 contains a weak password recovery vulnerability that allo... |
medium | 6.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108738 Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability t... |
medium | 4.2 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108742 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108730 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in lega... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108731 Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that al... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108732 Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108733 Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108734 Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108735 Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108724 Sylius through 2.3.0 contains an authorization bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108725 Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulne... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108726 GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.p... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108727 EdgeEver through 1.108.0 contains a missing authorization vulnerability in the H... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108728 Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability tha... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108729 Corteza through 2024.9.10 contains an incorrect authorization vulnerability in c... |
medium | 5.9 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108719 LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerabi... |
medium | 5.0 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108720 phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108721 Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity h... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.