October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62012 Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-62017 Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54858 Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-46651 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-118690 Signal K Server before 2.33.0 contains a missing authentication vulnerability th... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113399 Incorrect boundary conditions in the SVG component. |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnera... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a t... |
critical | 9.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUX... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-64024 In the Linux kernel, the following vulnerability has been resolved:
tcp: fix st... |
critical | 9.4 | — | Linux / linux kernel | 2026-07-19 | 2026-10-29 |
| CVE-2026-97854 Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103693 The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plug... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113616 The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-r... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-113617 The Automated Import Products to Cart WordPress plugin before 1.0.4 does not san... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115245 The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly valida... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116111 A vulnerability was determined in 2K Games Civilization V 1.0.3.144. |
critical | 9.6 | — | 2k / sid meiers civilization v | 2026-10-26 | 2026-10-29 |
| CVE-2026-109516 The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115964 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114615 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.1 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-49875 Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-29 |
| CVE-2026-55572 e107 is a content management system (CMS). |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-53921 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116863 Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletter... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-115607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2024-42360 SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user in... |
critical | 9.8 | — | Wurmlab / sequenceserver | 2024-08-14 | 2026-10-29 |
| CVE-2026-54630 Part-DB is an open source inventory management system for electronic components. |
critical | 9.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-10757 There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and e... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-107092 NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint. |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-85079 In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result... |
critical | 9.8 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-85080 In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can resul... |
critical | 9.1 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-94502 In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can res... |
critical | 9.8 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-39746 Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-29 |
| CVE-2026-96639 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-21 | 2026-10-29 |
| CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticate... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-29 |
| CVE-2026-103780 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103792 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.