October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108914 A flaw has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-94130 Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gal... |
critical | 9.8 | — | Joomlaboat / youtube gallery | 2026-09-26 | 2026-10-15 |
| CVE-2026-102676 Electron is a framework for writing cross-platform desktop applications using Ja... |
critical | 9.8 | — | Electronjs / electron | 2026-09-29 | 2026-10-15 |
| CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-10-14 | 2026-10-15 |
| CVE-2026-92464 Adobe Commerce is affected by an Improper Input Validation vulnerability that co... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-92909 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-4800 The fix for CVE-2021-23337 added validation for the variable option in _.templat... |
critical | 9.8 | — | Lodash / lodash | 2026-03-31 | 2026-10-15 |
| CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the re... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-103059 When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the pre... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-78308 Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. |
critical | 9.8 | — | Sqlite / sqlite | 2025-04-14 | 2026-10-15 |
| CVE-2024-47685 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
critical | 9.1 | — | Debian / debian linux | 2024-10-21 | 2026-10-15 |
| CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local atta... |
critical | 9.0 | — | Freeradius / freeradius | 2024-07-09 | 2026-10-15 |
| CVE-2023-45853 MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buf... |
critical | 9.8 | — | Zlib / zlib | 2023-10-14 | 2026-10-15 |
| CVE-2023-36660 The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption... |
critical | 9.8 | — | Nettle Project / nettle | 2023-06-25 | 2026-10-15 |
| CVE-2023-38408 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently t... |
critical | 9.8 | — | Openbsd / openssh | 2023-07-20 | 2026-10-15 |
| CVE-2026-105848 Payload is a free and open source headless content management system. |
critical | 9.6 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105857 Payload is a free and open source headless content management system. |
critical | 10.0 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105859 Payload is a free and open source headless content management system. |
critical | 9.8 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105863 Payload is a free and open source headless content management system. |
critical | 9.4 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-84198 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84209 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-16340 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14991 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15762 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14269 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14502 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-82101 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-82110 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-96119 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta... |
critical | 9.9 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-85440 MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulner... |
critical | 9.8 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85438 MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPF... |
critical | 9.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85437 MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP... |
critical | 9.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.