October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,457
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,359
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106575 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106569 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106570 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106571 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106568 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-106564 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-106566 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 4.4 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-62179 PraisonAI is a multi-agent teams system. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107169 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107174 A flaw was found in source-to-image. |
medium | 6.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107125 A flaw has been found in XnView Classic 2.52.5. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107167 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106559 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-confluence-to-markdown | 2026-10-07 | 2026-10-16 |
| CVE-2026-106560 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-confluence-to-markdown | 2026-10-07 | 2026-10-16 |
| CVE-2026-106561 Backstage is an open framework for building developer portals. |
medium | 5.0 | — | Linuxfoundation / backstage\/plugin-kubernetes-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-106562 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | Linuxfoundation / backstage\/plugin-search-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-106563 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-kubernetes-backend | 2026-10-07 | 2026-10-16 |
| CVE-2026-106064 A heap-based buffer overflow was found in GIMP’s GIF export plug-in. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104074 Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that all... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70519 The device log component of Fanvil x7a firmware version 2.6.0.1182 does not prop... |
medium | 6.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70515 The device log component of Fanvil x7a firmware version 2.6.0.1182 does not prop... |
medium | 6.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-88514 An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensiti... |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-45161 wger is a free, open-source workout and fitness manager. |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-46437 wger is a free, open-source workout and fitness manager. |
medium | 4.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-46438 wger is a free, open-source workout and fitness manager. |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-46571 In NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name()... |
medium | 5.5 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-102258 Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been ide... |
medium | 6.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-41958 A path traversal vulnerability exists in the unzip_http RemoteZipFile extract fu... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42532 A path traversal vulnerability exists in the EmailSheet extract_parts functional... |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107168 A flaw was found in m17n-lib. |
medium | 6.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107177 Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerabi... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105139 Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that al... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105140 Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in... |
medium | 4.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107151 Missing authentication has been found in remote-execution task updates in the sm... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107162 Express Gateway through 1.16.11 contains an authentication bypass vulnerability... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-105138 Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulne... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107159 MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerabi... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97294 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.