October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,475
Critical
1,339
High
5,868
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108607 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108608 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108609 JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerabili... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108610 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Ai... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-66480 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66481 Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. |
medium | 6.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62098 Unauthenticated Content Injection in Boutique <= 2.3.3 versions. |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62035 Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.... |
medium | 6.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-40808 Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions. |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42419 Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 ver... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103685 Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfill... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107420 Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryp... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107434 Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions. |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108602 Helicone through v2025.08.21-1 contains a server-side request forgery vulnerabil... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108604 Tabularis through 0.27.0 contains an incorrect authorization vulnerability in th... |
medium | 6.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108596 OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authent... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vuln... |
medium | 4.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108599 phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108600 open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link f... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-94590 Improper Verification of Source of a Communication Channel vulnerability in Code... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108591 InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authen... |
medium | 4.4 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerabili... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108593 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in... |
medium | 6.4 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108595 Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108585 argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerab... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108586 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorizati... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108579 OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allo... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108580 AniWorld Downloader before 5.3.0 contains an improper restriction of authenticat... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108581 TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerabilit... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108582 GenOffice through 0.11.505 contains an incorrect permissions vulnerability in it... |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerab... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108554 PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108555 PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP tha... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnera... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability th... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108547 AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-s... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108114 Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability th... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-66435 Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker... |
medium | 5.9 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108162 Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that al... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108163 Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerabilit... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.