October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,663
Critical
3,114
High
7,016
Medium
6,792
Low
599
Severity not reported
4,142
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17620 IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-91800 A local privilege escalation vulnerability exists in the installer of Foxit PDF... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-63161 Omnispace Agora Project before 26.10.0 contains a session fixation vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110599 L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110632 Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC servic... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110637 buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/k... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110642 xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.s... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110647 Turnpress through 0.4.2 contains an OS command injection vulnerability that allo... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110770 Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability t... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-74920 The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise a... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-105066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-86461 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arb... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110667 A security flaw has been discovered in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108491 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108498 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-107416 Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109692 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-84313 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-55682 WeGIA is a web manager for charitable institutions. |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-61844 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91811 A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-15 |
| CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability |
high | 7.2 | Listed | Palo Alto Networks / PAN-OS | 2026-10-14 | 2026-10-15 |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2026-07-04 | 2026-10-15 |
| CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-95631 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_modul... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91184 Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.b... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89288 The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a va... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is co... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-39781 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-92908 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 8.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-66877 Gitea enforces first-time fork contributor approval by blocking jobs, but some j... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-71184 Gitea's pull request review notifier does not attach the pull request to the Act... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110168 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110169 Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110171 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110172 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.