October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108740 GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulner... |
high | 8.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108746 Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108760 LlamaFarm through 0.0.34 contains an insecure default configuration that binds i... |
high | 7.6 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108853 UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnera... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108863 Katanemo Plano through 0.4.37 contains a missing authentication vulnerability th... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108865 AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that... |
high | 8.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108953 mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that a... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109238 Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109360 MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that all... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerabilit... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2020-37280 cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.dec... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2021-48011 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109426 Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerabil... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109560 Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vuln... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109568 Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in t... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109965 Serena before 2.0.0 contains an improper link resolution vulnerability that allo... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110097 Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110124 FastBee through 2.1.0 contains an insecure direct object reference vulnerability... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-82026 Radar before 1.12.2 contains a missing authorization vulnerability in the handle... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2017-20286 DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110633 MyReport Updater through 2.1.1 contains a local privilege escalation vulnerabili... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-70023 Use after free in Windows Hyper-V allows an authorized attacker to elevate privi... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85215 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-16 |
| CVE-2026-85457 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-13138 Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Softwa... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111702 ChatOllama through commit 96c3ce5 contains an insecure direct object reference v... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111722 LingGuo-Drama through commit 8a6924a contains an insecure direct object referenc... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111282 Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109715 Incorrect boundary conditions in the JavaScript Engine component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109716 Incorrect boundary conditions in the JavaScript Engine component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109712 Sandbox escape due to uninitialized memory in the Graphics component. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-70045 Use after free in Windows Work Folders allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates'... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109563 N3.js before 2.11.1 contains a regular expression denial of service vulnerabilit... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-70038 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.