October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80737 In the Linux kernel, the following vulnerability has been resolved:
serial: amb... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-80754 In the Linux kernel, the following vulnerability has been resolved:
Input: syna... |
high | 7.8 | — | — | 2026-09-03 | 2026-10-16 |
| CVE-2026-30971 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111642 FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111607 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111612 netdisk-fast-download through 0.4.8 contains an information disclosure vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111627 HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allow... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111279 Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability th... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-107794 ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB ar... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-105035 The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) us... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105036 EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105040 The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in a... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105033 The EnergizeLab AI Station (RK3562) firmware image ships with default root crede... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105034 The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary rob... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108259 Tina is a headless content management system. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108260 Tina is a headless content management system. |
high | 7.6 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. |
high | 7.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-103902 Improper verification of cryptographic signature vulnerability in DigiDoc libdig... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-77363 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57143 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59976 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59977 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65954 PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103030 Dio is a powerful HTTP client for Dart and Flutter. |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54640 OpenRemote is an open-source internet-of-things platform. |
high | 7.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-82416 FrankenPHP is a modern application server for PHP. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108379 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108380 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108384 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108385 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55601 MultiTail is a utility for monitoring multiple log files in one terminal. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-86022 VNote is a note-taking platform. |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103905 The authentication middleware of the JTL-Shop
administration backend processes t... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102944 cpp-httplib is a C++ header-only HTTP/HTTPS library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53999 Radius is a cloud-native, portable application platform that makes app developme... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55787 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-63626 Mongoose is an embedded web server and network library. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-73252 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.