October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106367 Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.80... |
high | 8.4 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-86361 Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2026-86362 Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Contr... |
high | 8.2 | — | Dell / system update | 2026-10-06 | 2026-10-14 |
| CVE-2022-2586 Linux Kernel Use-After-Free Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2024-01-08 | 2026-10-14 |
| CVE-2026-52296 FFmpeg before 9.0 has an out-of-bounds read because of missing required padding... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-96661 The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL In... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94377 The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-92817 The Ignition Perspective module does not properly validate session privileges wh... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-91156 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-52297 FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padd... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-17092 The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110622 Papermerge Core through 3.5.3 contains a missing authorization vulnerability tha... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109205 LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109228 SGLang through 0.5.21 contains a resource budget bypass vulnerability that allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108818 A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108806 A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-106599 Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart sur... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107426 Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey S... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104749 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104909 The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100163 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2025-14753 IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directori... |
high | 7.5 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2025-14754 IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitr... |
high | 8.8 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2026-88064 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-09-16 | 2026-10-14 |
| CVE-2026-110139 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110158 Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110207 Wukong AICRM through 20260610 contains a missing authorization vulnerability tha... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110233 Rovr through 0.10.3 on Windows contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110238 Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerabil... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108902 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulne... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-107701 dot-access through 1.0.0 contains a prototype pollution vulnerability that allow... |
high | 8.2 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-105442 IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97009 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-92910 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110208 Wukong AICRM through 20260610 contains a missing authorization vulnerability in... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110102 Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109704 Privilege escalation in the Application Update component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109739 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109743 Privilege escalation in the Panning and Zooming component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.