October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,509
Critical
3,103
High
6,974
Medium
6,735
Low
599
Severity not reported
4,098
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (699), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78530 Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108479 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108481 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108179 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109687 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108549 cc-connect through 1.5.0 contains a missing authentication vulnerability in the... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an a... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102119 A path traversal weakness in an optional, non-default administrative feature all... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102143 An unauthenticated attacker could cause a file with attacker-controlled content... |
high | 7.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2025-68613 n8n Improper Control of Dynamically-Managed Code Resources Vulnerability |
high | 8.8 | Listed | N8n / n8n | 2025-12-19 | 2026-10-13 |
| CVE-2026-84276 IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerabi... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84275 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM fil... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-78388 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-39460 Usernames and passwords, including the default factory credentials, are stored i... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-19493 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bun... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability th... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-81774 Exposure of Sensitive System Information to an Unauthorized Control Sphere vulne... |
high | 7.5 | — | — | 2026-09-02 | 2026-10-12 |
| CVE-2026-95594 Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. |
high | 8.1 | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-104084 SmarterMail before build 9777 contains a privilege escalation vulnerability wher... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling... |
high | 7.7 | — | — | 2026-10-07 | 2026-10-11 |
| CVE-2026-39453 Navigating to a certain URL on the switch’s web server causes the switch to rebo... |
high | 8.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-28745 Usernames and passwords, including the default credentials, are stored in the co... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-29797 No authentication is required when updating firmware or bootloader, making it ea... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-33367 SNMP can be used to perform administrative actions such as retrieving configurat... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105281 The internal data publisher on openPDC accepts network connections without authe... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-102262 Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-97076 Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocke... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94666 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96336 Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminato... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94064 Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Sho... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94065 Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio color... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105872 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurato... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95608 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96329 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94158 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94159 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.