October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86131 A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client... |
critical | 9.8 | — | Watchguard / fireware | 2026-09-30 | 2026-10-06 |
| CVE-2026-105845 Payload is a free and open source headless content management system. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106102 Quasar Framework is a framework for building high-performance Vue.js user interf... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105740 Langflow is a tool for building and deploying AI-powered agents and workflows. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88416 MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/f... |
critical | 9.8 | — | — | 2026-09-22 | 2026-10-06 |
| CVE-2026-88393 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export inter... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94293 An unauthenticated remote attacker can modify Asset Administration Shell submode... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-77178 Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bound... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105778 A vulnerability has been found in Tenda AC5 02.03.01.111_multi. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon Sag... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-87830 In the StAX streaming WS-SecurityPolicy validator, certain relative or unsupport... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-89238 WSS4J EncryptedHeader child confusion could promote an attacker-controlled plain... |
critical | 9.1 | — | Apache / wss4j | 2026-09-30 | 2026-10-06 |
| CVE-2026-76570 Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and writ... |
critical | 9.1 | — | Joomcode / jc tables | 2026-09-30 | 2026-10-06 |
| CVE-2026-88424 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the f... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-106037 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105691 Penpot is an open-source design and prototyping platform. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105080 In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, an... |
critical | 9.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTRO... |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102425 Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injecti... |
critical | 10.0 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-101127 Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in B... |
critical | 9.4 | — | Balbooa / forms | 2026-09-29 | 2026-10-06 |
| CVE-2026-16346 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-09-22 | 2026-10-06 |
| CVE-2026-84075 IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass securi... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84073 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84064 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82832 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.6 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82340 IBM Guardium Data Protection 12.2 is vulnerable to unauthenticated insecure dese... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-103630 Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-06 |
| CVE-2026-37719 An issue in dormakaba evolo Service (all versions) allows a remote attacker to e... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105793 Microsoft UFO is an open-source framework for intelligent automation across devi... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2023-54405 H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82041 UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-88395 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbis... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88391 Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables th... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105105 CWE-306: Missing Authentication for Critical Function in the ait.core.server tel... |
critical | 9.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-84031 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
critical | 9.0 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-82967 IBM Guardium Data Protection 12.2 is vulnerable to an authentication bypass that... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84078 IBM Guardium Data Protection 12.2 is vulnerable to a missing authentication vuln... |
critical | 9.9 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-84082 IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbit... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-81478 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-82042 UTMStack before 11.2.16 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.