October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,327
High
5,804
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108594 Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerabilit... |
low | 3.5 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108505 ZTE Z80 Ultra has a local information disclosure vulnerability. |
low | 3.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108503 ZTE Z80 Ultra has an interface permission validation vulnerability. |
low | 3.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104006 The SpeedyCache – Cache, Optimization, Performance plugin for WordPress is vulne... |
low | 3.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108502 ZTE Z80 Ultra contains an information disclosure vulnerability, through which th... |
low | 3.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-105977 The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a pe... |
low | 2.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104741 The AI Puffer – Chat. |
low | 3.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104742 The AI Puffer – Chat. |
low | 3.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104754 The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redir... |
low | 3.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107848 Contao is an Open Source CMS. |
low | 3.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-96393 The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform ad... |
low | 3.6 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96394 The Affinity by Canva application for macOS before 3.3.1 (October 2026 release)... |
low | 2.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96395 The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not... |
low | 3.6 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-101130 The Affinity by Canva application before 3.3.1 (October 2026 release) did not pe... |
low | 3.6 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-101094 The Affinity by Canva application before 3.3.1 (October 2026 release) did not co... |
low | 3.6 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78017 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
low | 3.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-106095 The Code Snippets WordPress plugin before 3.10.0 does not perform a capability c... |
low | 3.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107727 Strawberry GraphQL is a library for creating GraphQL APIs. |
low | 3.7 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-88648 Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a... |
low | 3.7 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2026-67693 An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information v... |
low | 3.7 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-106438 An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver ca... |
low | 3.7 | — | Mongodb / c driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-106428 An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C... |
low | 3.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107296 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
low | 3.7 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107676 FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability i... |
low | 3.3 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107288 Pydantic AI is a Python agent framework for building applications and workflows... |
low | 3.7 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-89290 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
low | 3.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107570 heap OOB write in convert_file_from_to() via a crafted Content-Type header allow... |
low | 2.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-94258 The SMS Alert WordPress plugin before 4.0.1 does not check that the acting admin... |
low | 2.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105195 The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict... |
low | 2.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105196 The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce pe... |
low | 3.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105197 The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify tha... |
low | 2.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104645 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not... |
low | 2.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107449 linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection me... |
low | 3.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94584 A race condition and thread-safety vulnerability exists in the web management da... |
low | 2.6 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-107448 Magic: The Gathering Arena (Windows/Steam client; 2026.59.30.12801.127931.6 and... |
low | 3.4 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-94583 A race condition vulnerability exists in the request processing logic of the RES... |
low | 2.6 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-92862 The Android application "Ticket Ryutsu Center" improperly handles custom URL sch... |
low | 3.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87726 Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through... |
low | 3.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107283 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
low | 3.7 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107284 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
low | 3.7 | — | — | 2026-10-07 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.