October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85432 MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB messag... |
high | 8.2 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-107428 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107431 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97278 Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang a... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94578 Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerab... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-12613 Deserialization of untrusted data vulnerability in Ministry of Justice General D... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18390 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108967 A security flaw has been discovered in SourceCodester Performance Indicator Syst... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108975 A security flaw has been discovered in SourceCodester Library Management System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109116 A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. |
high | 7.2 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. |
high | 8.0 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. |
high | 8.5 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-78341 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.2 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78026 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78023 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78020 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-14814 GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-94582 A memory buffer overflow vulnerability exists in the internal diagnostic and rou... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-81839 GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-96893 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
high | 7.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side te... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege esca... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2025-61682 Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users... |
high | 8.6 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-71421 UVdesk core-framework before 1.1.7 contains an improper privilege management vul... |
high | 7.2 | — | — | 2026-09-21 | 2026-10-14 |
| CVE-2025-1281 The BM Content Builder plugin for WordPress is vulnerable to arbitrary file dele... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-14 |
| CVE-2025-51457 D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vu... |
high | 8.8 | — | — | 2026-09-25 | 2026-10-14 |
| CVE-2025-71423 Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71425 Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and... |
high | 7.3 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-71426 Contrast is a confidential-computing runtime for Kubernetes. |
high | 7.1 | — | — | 2026-09-27 | 2026-10-14 |
| CVE-2025-15643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-14 |
| CVE-2025-45871 LogicalDOC Enterprise up to and for 9.1.1 is vulnerable to blind SQL injection i... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-76266 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux... |
high | 7.7 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-84312 Nginx UI is a web user interface for the Nginx web server. |
high | 7.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85960 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85950 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85954 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-106625 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.