October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104626 A user who can open a fork pull request can place workflow content with a shared... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-87665 A stack-based buffer overflow vulnerability exists in the Internet Key Exchange... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-104632 Gitea Actions blocks the jobs of workflow runs from first-time fork pull request... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104636 Gitea validated the initial remote URL for push mirrors, wiki remote checks, and... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-78025 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.5 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-75345 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-75347 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired poi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-32574 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-42702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109673 Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-s... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109372 ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypa... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in t... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109334 SurrealDB before 3.3.0 does not check the caller-selected namespace or database... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109343 SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE stat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109225 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108921 A vulnerability was detected in KusalkaSilva Learning-Management-System up to ff... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108101 HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108106 Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerab... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108159 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-70357 Gitea validates a repository migration hostname against its network allow and bl... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-87671 An out-of-bounds memory read vulnerability exists in the web management daemon o... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-79960 When a push was authenticated with a deploy key, Gitea recorded the repository o... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-89430 Gitea validated a push mirror's remote address against the `[migrations]` allow... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-76769 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78018 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78339 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78024 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78022 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78019 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-88930 The Social Web Suite WordPress plugin through 4.1.12 does not require its shared... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89195 The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89213 The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and esc... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89214 The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89232 The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89234 The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a par... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89283 The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perfor... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-89285 The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape seve... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.