October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,416
Critical
3,098
High
6,960
Medium
6,692
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106199 Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8... |
high | 8.2 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-105920 A vulnerability was determined in Kusalkasilva Learning-Management-System up to... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105835 PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST... |
high | 7.4 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105840 lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive u... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105791 Microsoft UFO is an open-source framework for intelligent automation across devi... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105796 Kiota is an OpenAPI based HTTP Client code generator. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-56851 The Nickname profile can panic with an out-of-bounds slice error when transformi... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107376 webonyx graphql-php is a PHP implementation of the GraphQL specification. |
high | 8.2 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106557 Backstage is an open framework for building developer portals. |
high | 7.7 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-105830 league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of s... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66084 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107709 A path traversal vulnerability exists in Bower decompress-zip through version 0.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44031 Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107611 An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Vie... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107612 Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107615 An uncontrolled search path element vulnerability in GlavSoft TightVNC Server fo... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62251 Homer is open source telecom observability software. |
high | 8.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107205 LMCache through 0.5.5 contains a missing authentication vulnerability in the mul... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107207 LMCache through 0.5.5 contains a server-side request forgery vulnerability in it... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsiste... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/ |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103010 Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEn... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103647 Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 throu... |
high | 8.0 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103649 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104658 The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMa... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104659 Missing Host header validation and missing throttling of failed administrator si... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104660 Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104704 Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbo... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107573 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107574 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMail... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107576 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verific... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107577 Inefficient algorithmic complexity and a non-terminating loop in the MIME proces... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107579 Inefficient algorithmic complexity in the bounce and complaint processing of Pro... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107584 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107589 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103309 The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who c... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106164 In Progress® Telerik® Document Processing SpreadProcessing library, versions pri... |
high | 7.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107300 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.