October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,663
Critical
3,114
High
7,016
Medium
6,792
Low
599
Severity not reported
4,142
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73597 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-93695 In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyServic... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transpor... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-102849 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102850 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-72895 A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105591 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105592 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105593 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-109305 Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105106 Koha is vulnerable to OS command injection in the Task Scheduler deletion path. |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105107 Koha is vulnerable to SQL injection in the Most-circulated items report. |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-63153 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63158 Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnera... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63159 Omnispace Agora Project before 26.10.0 contains a predictable password-reset tok... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63162 Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability t... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63163 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105595 Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-74034 Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgra... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74036 Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability wh... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-74045 Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-105596 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105597 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105598 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105714 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105716 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-105717 Heap-based buffer overflow in Microsoft Office Access allows an unauthorized att... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-110769 holaOS through 2026.822.1 contains a missing authorization vulnerability in chan... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109671 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109613 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109608 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109312 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in proces... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109313 Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109314 Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109317 Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109318 Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability th... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-63149 Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerabi... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63154 Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulne... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2020-37281 Gravitee API Management through 4.12.22 contains an authentication bypass vulner... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.