October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12985 Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Matterm... |
critical | 9.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-07 |
| CVE-2017-12149 Red Hat JBoss Application Server Remote Code Execution Vulnerability |
critical | 9.8 | Listed | Red Hat / JBoss Application Server | 2017-10-04 | 2026-10-07 |
| CVE-2026-62176 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-51862 DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/sr... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-51869 DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-07 |
| CVE-2026-105812 Improper control of code generation in the agent import functionality of Amazon... |
critical | 9.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Pla... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2020-9493 A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 whic... |
critical | 9.8 | — | Apache / chainsaw | 2021-06-16 | 2026-10-07 |
| CVE-2026-59346 VMware Workstation and Fusion contain an integer-overflow vulnerability. |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-51882 The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-106234 Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-102149 Kiteworks Email Protection Gateway did not sufficiently restrict which account a... |
critical | 9.4 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-102147 A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an un... |
critical | 9.3 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-65669 Improper neutralization of special elements in output used by a downstream compo... |
critical | 9.6 | — | Microsoft / sql server management studio | 2026-09-08 | 2026-10-07 |
| CVE-2026-102115 Kiteworks Core did not correctly validate a parameter submitted to the password... |
critical | 9.8 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-07 |
| CVE-2026-106239 Integer overflow in WebGL in Google Chrome on on Android prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106241 Incorrect authorization in Search in Google Chrome on on Android prior to 155.0.... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-62874 Insufficient verification of data authenticity in Azure Billing allows an unauth... |
critical | 9.8 | — | Microsoft / azure billing | 2026-09-18 | 2026-10-07 |
| CVE-2026-106372 Incorrect authorization in UI in Google Chrome prior to 155.0.8059.39 allowed a... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106375 Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a rem... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106382 Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106281 Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106298 Use after free in Chrome Tabs in Google Chrome on on Mac prior to 155.0.8059.39... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106323 Missing authorization in Chrome for iOS in Google Chrome on on iOS prior to 155.... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106401 Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-101155 An authenticated remote attacker with specific permissions can read or write fil... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102159 An access-control flaw in the CV-CUE backend may allow an unauthenticated networ... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106329 Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 al... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106414 Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.80... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106417 Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106419 Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 al... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2025-15073 A vulnerability was determined in itsourcecode Online Frozen Foods Ordering Syst... |
critical | 9.8 | — | Itsourcecode / online frozen foods ordering system | 2025-12-24 | 2026-10-07 |
| CVE-2025-15074 A vulnerability was identified in itsourcecode Online Frozen Foods Ordering Syst... |
critical | 9.8 | — | Itsourcecode / online frozen foods ordering system | 2025-12-25 | 2026-10-07 |
| CVE-2025-15075 A security flaw has been discovered in itsourcecode Student Management System 1.... |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-25 | 2026-10-07 |
| CVE-2025-15077 A security vulnerability has been detected in itsourcecode Student Management Sy... |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-25 | 2026-10-07 |
| CVE-2025-15078 A vulnerability was detected in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-25 | 2026-10-07 |
| CVE-2025-59683 Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the... |
critical | 9.1 | — | Pexip / pexip infinity | 2025-12-25 | 2026-10-07 |
| CVE-2025-15089 A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. |
critical | 9.8 | — | Utt / 512w firmware | 2025-12-25 | 2026-10-07 |
| CVE-2025-15090 A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. |
critical | 9.8 | — | Utt / 512w firmware | 2025-12-25 | 2026-10-07 |
| CVE-2025-15091 A vulnerability was determined in UTT 进取 512W up to 1.7.7-171114. |
critical | 9.8 | — | Utt / 512w firmware | 2025-12-26 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.