October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51876 DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confi... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51881 deeptutor 1.4.0 contains code injection in ExecTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-53953 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-104846 Seroval facilitates JS value stringification, including complex structures beyon... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-103109 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.4 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-103110 Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper in... |
critical | 9.8 | — | Pexip / pexip infinity | 2026-09-30 | 2026-10-05 |
| CVE-2026-105637 Plane is an open-source project management tool. |
critical | 9.6 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-92071 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92075 Mitigation bypass in the Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-51911 vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_fig... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51918 FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code (). |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51893 infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mi... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51897 RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluat... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51904 SuperAGI up to v0.0.14 contains an improper access control vulnerability in the... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-51879 deeptutor 1.4.0 contains an authorization bypass through a user-controlled objec... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51883 The knowledge base creation and document upload interfaces in Langchain-Chatchat... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-51884 The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langc... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-105638 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105640 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104056 Authlib version 1.7.2 and below contains a vulnerability where discovery JSON me... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-92079 Mitigation bypass in the Widget: Win32 component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92057 Mitigation bypass in the Enterprise Policies component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92059 Incorrect boundary conditions in the DOM: Editor component. |
critical | 9.3 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92061 Incorrect boundary conditions in the Security: Process Sandboxing component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92066 Sandbox escape in the Profile Backup component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92048 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.0 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92050 Sandbox escape due to race condition in the XPConnect component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92051 Spoofing issue due to invalid pointer in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-86930 An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an att... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-86934 An authorization bypass vulnerability in the FileMaker Server Web Publishing Eng... |
critical | 9.1 | — | Claris / filemaker server | 2026-09-23 | 2026-10-05 |
| CVE-2026-92609 Session fixation in HTTP management authentication allows remote attackers to ga... |
critical | 9.8 | — | Apache / qpid broker-j | 2026-09-25 | 2026-10-05 |
| CVE-2026-92032 Sandbox escape due to invalid pointer in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92034 Site isolation issue in the Graphics component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92035 Sandbox escape due to incorrect boundary conditions in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92036 Incorrect boundary conditions in the Networking: HTTP component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92037 Incorrect boundary conditions in the DOM: Animation component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92038 Mitigation bypass in the Remote Settings Client component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92041 Mitigation bypass in the DOM: Networking component. |
critical | 9.1 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-92045 Sandbox escape due to incorrect boundary conditions in the WebRTC component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-05 |
| CVE-2026-51880 deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.