October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110211 iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability t... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110216 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109607 A flaw has been found in SourceCodester Online Exam System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108376 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108381 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109429 Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerabili... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85114 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webser... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55376 Heym builds and runs agentic systems and business-process automations on self-ho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111671 Cube-studio through 2026.09.01 contains an insecure direct object reference vuln... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111681 EFAK through 5.1.0 contains a missing authorization vulnerability that allows au... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111686 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111691 WIMOOR through commit ec86736 contains an authentication bypass vulnerability th... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111701 OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability t... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111706 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111636 OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109967 yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111606 Huly Platform through 0.7.432 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109522 A vulnerability has been found in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109115 A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109405 A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108966 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108970 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108974 A vulnerability was identified in SourceCodester E-Learning System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-79957 ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usua... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated re... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106089 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106090 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-16 |
| CVE-2026-105901 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105900 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-96915 Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-105897 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published... |
high | 7.3 | — | Techfry / tf content | 2026-10-05 | 2026-10-16 |
| CVE-2026-105751 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-16 |
| CVE-2026-105759 vLLM is an inference and serving engine for large language models. |
high | 7.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-16 |
| CVE-2026-93590 ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR e... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-09-18 | 2026-10-16 |
| CVE-2026-77396 PJSIP is a free and open source multimedia communication library written in C. |
high | 7.1 | — | Teluu / pjsip | 2026-09-18 | 2026-10-16 |
| CVE-2026-88755 Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections wi... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-80731 In the Linux kernel, the following vulnerability has been resolved:
net: remove... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.