October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109186 jshERP through 3.6 contains a mass assignment vulnerability in the UserControlle... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109326 Grav before 2.1.7 contains an information disclosure vulnerability because bundl... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109604 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109612 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-111898 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnera... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111909 phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the dele... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111389 Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 co... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-110615 jshERP through 3.6 contains a missing authorization vulnerability in the POST /u... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-109399 SWUpdate through 2026.05.1 contains an improper certificate validation vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109286 Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vul... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109291 Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerabili... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109199 LogicalDOC Community Edition through 9.3 contains a code injection vulnerability... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109227 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in p... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108859 mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTT... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108718 Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108657 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-108553 OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-18 |
| CVE-2026-96658 A flaw was found in Foreman. |
high | 8.8 | — | Redhat / satellite | 2026-10-01 | 2026-10-18 |
| CVE-2026-93485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-18 | 2026-10-17 |
| CVE-2026-94177 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-09-30 | 2026-10-17 |
| CVE-2026-88101 Weak authentication in Microsoft Input Method Editor (IME) allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-17 |
| CVE-2026-85338 Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-17 |
| CVE-2026-103946 An SQL injection vulnerability could allow an authenticated user to read or modi... |
high | 8.3 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-95633 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-63152 Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vul... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63174 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110112 Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temp... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-106623 ColdFusion is affected by an Incorrect Authorization vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-17 |
| CVE-2026-102599 Socket.IO enables bidirectional and low-latency communication for every platform... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-100113 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-100118 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-100123 CAI Content Credentials is affected by an Improper Certificate Validation vulner... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-17 |
| CVE-2026-85990 Leantime is an open source project management system. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerabi... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110128 fuint through commit 4c4bc8a contains a missing authentication vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110206 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.