October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87762 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have a... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87764 The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88826 The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or C... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88827 The Disable Users WordPress plugin through 1.0.5 does not enforce its account-di... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88903 The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88905 The KeyWord Collector WordPress plugin through 1.4 does not have any authorisati... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-100761 Privilege escalation due to use-after-free in the Graphics: WebGPU component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-97687 urllib3 is an HTTP client library for Python. |
high | 8.1 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-97689 urllib3 is an HTTP client library for Python. |
high | 7.5 | — | Python / urllib3 | 2026-09-29 | 2026-10-13 |
| CVE-2026-96236 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-96188 External control of system or configuration setting in Microsoft PowerToys allow... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110255 Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108905 pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key v... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108783 A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit... |
high | 8.2 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-107391 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107392 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-109521 A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109525 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109606 A vulnerability was detected in SourceCodester Art Gallery Management System 1.0... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability |
high | 8.6 | Listed | Ivanti / Connect Secure | 2026-10-13 | 2026-10-13 |
| CVE-2026-109325 Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109185 jshERP through 3.6 contains a missing authorization vulnerability in the UserCon... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in lo... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108826 A vulnerability was found in Zen Cart up to 2.2.2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108836 A vulnerability has been found in Ollama up to 0.34.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108805 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-63697 Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate... |
high | 7.2 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead... |
high | 8.8 | — | Elastic / kibana | 2026-10-06 | 2026-10-13 |
| CVE-2026-71168 Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation o... |
high | 7.8 | — | Dell / system update | 2026-10-06 | 2026-10-13 |
| CVE-2026-100764 Privilege escalation due to incorrect boundary conditions in the Graphics: WebGP... |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100765 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2021-22555 Linux Kernel Heap Out-of-Bounds Write Vulnerability |
high | 7.8 | Listed | Linux / Kernel | 2021-07-07 | 2026-10-13 |
| CVE-2026-84317 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-54641 OpenRemote is an open-source internet-of-things platform. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-86684 The Gitea push mirror API checked whether the repository owner, instead of the r... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host... |
high | 7.4 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-83540 When password or public key authentication is used with the Windows port of wolf... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-87682 Multiple OS Command Injection vulnerabilities exist in the management interface... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87683 Multiple stack-based buffer overflow vulnerabilities exist in the REST API manag... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.