October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51875 In Devika v1.0, the Feature Agent save_code_to_project function contains a path... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-100810 Other issue in the DevTools component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100811 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100818 Sandbox escape due to use-after-free in the Widget: Gtk component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100778 Sandbox escape due to use-after-free in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2025-1009 An attacker could have caused a use-after-free via crafted XSLT data, leading to... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1016 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19,... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1017 Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, a... |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2025-1020 Memory safety bugs present in Firefox 134 and Thunderbird 134. |
critical | 9.8 | — | Mozilla / firefox | 2025-02-04 | 2026-10-05 |
| CVE-2026-103628 Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-103626 Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-10-02 | 2026-10-05 |
| CVE-2026-100781 Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100819 Sandbox escape due to incorrect boundary conditions in the XPCOM component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100786 Sandbox escape due to use-after-free in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-100787 Sandbox escape in the XUL component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using look... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared sessio... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-97637 The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass vi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-14378 The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leadi... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-19660 The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-19652 The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation i... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-103648 Path traversal in image-downloader 4.3.0 allows an attacker who can control the... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97413 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs-s... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-76504 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability |
critical | 9.8 | Listed | Cisco / Catalyst SD-WAN Manager | 2026-09-30 | 2026-10-03 |
| CVE-2026-100255 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 administrator account... |
critical | 9.8 | — | Jetbrains / teamcity | 2026-09-30 | 2026-10-02 |
| CVE-2026-88920 An authentication bypass in the DOM security processor in Apache WSS4J allows un... |
critical | 9.8 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-51858 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-15896 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103765 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93697 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multila... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103764 Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102795 Improper Access Control vulnerability in Apache Traffic Server. |
critical | 9.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-89134 A certificate with no dNSName SAN but another SAN type present (e.g. |
critical | 9.1 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-55083 DHIS2 is a flexible information system for data capture, management, validation,... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-93029 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103922 Capacitor is a cross-platform native runtime for web applications. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-90970 GitLab has remediated a vulnerability in the GitLab AI Gateway component affecti... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-77987 A server-side request forgery (SSRF) vulnerability was identified in the noteboo... |
critical | 9.8 | — | Github / enterprise server | 2026-09-22 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.