October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107833 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107816 MariaDB server is a community developed fork of MySQL server. |
medium | 6.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107817 MariaDB server is a community developed fork of MySQL server. |
medium | 4.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107819 MariaDB Connector/C is a C and C++ client library for connecting applications to... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107820 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg tha... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75597 pyLoad is a free and open-source download manager written in Python. |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-42695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-48484 pyLoad is a free and open-source download manager written in Python. |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108093 A flaw was found in GIMP. |
medium | 5.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108119 A flaw was found in busybox. |
medium | 6.3 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108158 plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the wh... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2016-20098 Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cro... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108110 MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-ap... |
medium | 6.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108111 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in t... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108112 ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107783 Insertion of sensitive information into log file in AWS Tools for PowerShell bef... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104083 SmarterMail before build 9777 contains a stored mutation cross-site scripting vu... |
medium | 6.1 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-32645 Default factory credentials with administrative access are enabled and persist e... |
medium | 6.0 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-33272 A malicious user with physical access to the device can boot the switch from fac... |
medium | 4.9 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108124 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
medium | 4.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108103 Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pf... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108104 Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulne... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108105 Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_han... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108100 HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability tha... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108102 Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pf... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107804 Nginx UI is a web user interface for the Nginx web server. |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-92085 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-85479 The STTP-based data publisher on openPDC accepts network connections without aut... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-79363 Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108063 A flaw was found in libhangul. |
medium | 5.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107803 ProcessMaker is an open source workflow management software suite. |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-101022 A Modbus connection feature on openPDC accepts a caller-specified destination ad... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96396 The Affinity by Canva application for macOS before 3.3.1 (October 2026 release)... |
medium | 4.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62028 Missing Authorization vulnerability in bPlugins Before After Image Comparison –... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-62029 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106601 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automa... |
medium | 5.4 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106602 Authentication Bypass Using an Alternate Path or Channel vulnerability in Automa... |
medium | 4.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-103220 The Affinity by Canva application before 3.3.1 (October 2026 release) did not pe... |
medium | 4.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104079 Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-85348 The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF pro... |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.