October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,327
High
5,804
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109270 ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process... |
low | 3.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109271 ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109272 ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109274 ImageMagick before 7.1.2-32 contains a time-of-check time-of-use symlink race vu... |
low | 2.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109263 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recur... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109268 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a use after free v... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109258 ImageMagick 7.1.0-20 before 7.1.2-32 contains an invalid memory free vulnerabili... |
low | 2.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109260 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109261 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in t... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109247 FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedes... |
low | 3.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb... |
low | 3.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109241 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the c... |
low | 3.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108908 A vulnerability was identified in Netcore NR268 1.7.121109. |
low | 2.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109195 A flaw was found in Quay. |
low | 3.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108901 A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108898 A vulnerability was detected in Netis WF2409E 3.3.42541. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-103526 In Thelia v2.6.0, both the administrative login and forgotten password endpoints... |
low | 3.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105081 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account f... |
low | 3.6 | — | — | 2026-10-12 | 2026-10-29 |
| CVE-2026-108815 A vulnerability has been found in idcCMS 1.70. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108809 A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108808 A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. |
low | 2.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2025-15703 The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of i... |
low | 3.5 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-108802 A weakness has been identified in y_project RuoYi up to 4.8.3. |
low | 3.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108981 ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in cer... |
low | 3.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-18418 The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc... |
low | 3.4 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108857 Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext loggin... |
low | 3.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108851 phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MC... |
low | 3.3 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108754 GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes... |
low | 3.3 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108745 CloudBeaver through 25.3.5 contains a missing authorization vulnerability in Web... |
low | 3.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108741 Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guar... |
low | 3.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108736 Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability t... |
low | 3.7 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108723 answer-me-with-html through 0.5.0 contains a link following vulnerability in the... |
low | 2.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108566 A vulnerability has been found in InstantSoft icms2 up to 2.18.2. |
low | 3.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-107507 The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on... |
low | 2.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-107694 The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plu... |
low | 2.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104681 The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image... |
low | 2.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104682 The Envira Gallery WordPress plugin before 1.16.2 does not correctly check autho... |
low | 2.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104684 The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is... |
low | 2.7 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108603 slide-maker through 5.8.0 contains a path traversal vulnerability in generate_im... |
low | 3.3 | — | — | 2026-10-10 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.