October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105037 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105038 The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services exp... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105039 EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105032 The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102693 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108261 Tina is a headless content management system. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108263 Astron Agent is an agentic workflow platform for building and running AI agents. |
critical | 9.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108264 Wizarr is an advanced user invitation and management system for Jellyfin, Plex,... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-89309 The authorization middleware of the WMS MobileServer
fails to require authentica... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55695 FearlessCMS is a flat-file content management system centered on simplicity and... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55183 RClone Manager is a cross-platform GUI application designed to help users manage... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89310 A parameter taken from the request body is inserted into
a T-SQL statement witho... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary
consent names from una... |
critical | 9.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108390 Hestia Control Panel is a lightweight and powerful control panel for the modern... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55573 e107 is a content management system (CMS). |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105279 In the default configuration, the archive accepts DICOM associations from an unr... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-97851 The storage status-change REST service allows location records still associated... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85818 Improper verification of cryptographic signature in Windows Schannel allows an u... |
critical | 9.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-78802 An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78799 Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing)... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-37107 An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via th... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-52394 DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104585 Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110392 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108065 SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110911 Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted valu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95182 An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attack... |
critical | 10.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-66086 In the modem OTA stack, there is a possible stack-based buffer overflow due to i... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109575 In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edit... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential st... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-84731 An unauthenticated remote attacker can bypass authentication and gain full acces... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-85806 Integer underflow (wrap or wraparound) in Network Policy Server (NPS) allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85809 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96924 Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85814 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108551 openapi-typescript-codegen through 0.31.0 contains a code injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-111094 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-108598 Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateE... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108753 Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability... |
critical | 9.4 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.