October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,859
Critical
1,275
High
5,585
Medium
5,949
Low
622
Severity not reported
3,428
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53711 MCP Context Forge provides an MCP Admin UI for managing gateway resources. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-18228 HyperScale contained a path traversal issue affecting information disclosure. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-4869 A potential privilege escalation issue was identified in InstallShield version 2... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-12655 A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated a... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-12656 A denial-of-service security issue exists in the affected product and version. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106108 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102603 Gotify server is a simple server for sending and receiving messages in real-time... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102250 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists tha... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58771 AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overf... |
not reported | — | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2025-58772 AMI APTIOV contains vulnerabilities in BIOS where users may cause
“Classic Buff... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58773 AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58774 AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-0893 AMI APTIOV contains a vulnerability in BIOS
where an attacker may cause “Exposur... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109763 Mitigation bypass in the File Handling component. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-63316 A SQL injection vulnerability has been identified in Payload CMS. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109162 Forms using FileUpload or ImageUpload elements with a custom saveToFileMount con... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-96535 Cross-Site Scripting on the YouMind portal, specifically in the avatar update en... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-75826 Command injection in the backup function in Teltonika Networks RUTOS 7.22 before... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109758 Perforce Helix Authentication Service (HAS) deployments that retain the shipped... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-44828 Qexo is an open source online editor for static blogs. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-49483 Code for IBMi is a Visual Studio Code extension for maintaining and compiling IL... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-49484 Code for IBM i is a Visual Studio Code extension for maintaining and compiling I... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102539 Super Productivity is an advanced todo list app with integrated timeboxing and t... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-58462 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-84314 Nginx UI is a web user interface for the Nginx web server. |
not reported | — | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-95838 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108362 Privasys Remote Attestation TLS Clients provides multi-language utilities for ve... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108361 Privasys Remote Attestation TLS Clients provides multi-language utilities for ve... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2021-48009 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-89140 Temporal Server does not bind internal completion callbacks to the namespace tha... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103061 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104102 copyparty is a portable file server. |
not reported | — | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104355 A connected peer cluster can modify a Temporal Server cluster's local namespaces... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-6232 An out-of-bounds write vulnerability in the SPI host command interface of Semtec... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109222 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105274 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-92681 In @neo4j/graphql versions up to and including 7.6.3, @authentication directives... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92682 In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none qu... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96612 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96618 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.