October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104748 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-84249 IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-73595 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-9191 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-101956 An Improper Authentication vulnerability in the J-Web web management component o... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33792 A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Net... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33796 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101983 A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101980 An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS wi... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-70242 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-7826 A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-55684 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55680 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55683 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109686 Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109110 A flaw has been found in Wavlink WL-WN592AX6 250422. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108892 A vulnerability was determined in Linksys E1700 1.0.0.4.003. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108896 A vulnerability was found in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108804 A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03... |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-107908 A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107909 A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) a... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2017-5674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, a... |
critical | 9.8 | — | Embedthis / goahead | 2017-03-13 | 2026-10-15 |
| CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application lis... |
critical | 9.1 | — | Apache / tomcat | 2017-04-17 | 2026-10-15 |
| CVE-2026-97016 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97749 Double free in Microsoft Office Outlook allows an unauthorized attacker to execu... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-91881 Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improp... |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110536 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109694 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109688 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17618 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-15 |
| CVE-2026-110645 Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110650 The thumbnail Python package through 1.5 contains an OS command injection vulner... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109145 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109698 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109892 Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-16740 Missing authentication for critical function vulnerability in TR7 Cyber Defense... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-16741 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-8037 Progress LoadMaster Command Injection Vulnerability |
critical | 9.8 | Listed | Progress / LoadMaster | 2026-06-04 | 2026-10-15 |
| CVE-2026-108918 A vulnerability was identified in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.