October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,410
Critical
3,098
High
6,954
Medium
6,692
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105806 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106105 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106106 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-9032 Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboard... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-105764 Immich is a high-performance self-hosted photo and video management solution. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104914 MISP contains an improper access control vulnerability in its attribute search a... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103446 Authorization bypass through User-Controlled key vulnerability in The Wikimedia... |
not reported | — | — | — | 2026-09-30 | 2026-10-06 |
| CVE-2026-97149 In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-C... |
not reported | — | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105786 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105050 PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS comman... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104966 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105686 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104855 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-79113 OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104055 The postgresql-operator charm runs a Prometheus postgres_exporter to collect dat... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105090 Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0482 In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59357 Insufficient verification of data authenticity (CWE-345) in the external OIDC lo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59358 Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry U... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-80327 An open redirect vulnerability exists in the PingGateway Fragment Filter feature... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59782 The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerabili... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59783 The Zabbix Server/Proxy has a vulnerability where binary items can crash the Ser... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59785 Host search in Frontend allows filtering by fields that are not displayed, inclu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59787 The Perl SNMP trap receiver script shipped with Zabbix does not properly neutral... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59788 The email media type OAuth form passes the Authorization endpoint value to windo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functiona... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause th... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerab... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.