October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94541 The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerabl... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-79687 Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vu... |
critical | 10.0 | — | Dell / powerstoreos | 2026-09-01 | 2026-10-02 |
| CVE-2026-55176 Soft Machine is a Virtual Machine–based agentic development environment / Cloud... |
critical | 9.0 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-100273 In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts de... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-100277 In JetBrains YouTrack before 2026.2.19197 account takeover was possible by repla... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-09-30 | 2026-10-02 |
| CVE-2026-93985 OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in th... |
critical | 9.9 | — | — | 2026-09-19 | 2026-10-02 |
| CVE-2010-2861 Adobe ColdFusion Directory Traversal Vulnerability |
critical | 9.8 | Listed | Adobe / ColdFusion | 2010-08-11 | 2026-10-02 |
| CVE-2018-7602 Drupal Core Remote Code Execution Vulnerability |
critical | 9.8 | Listed | Drupal / Core | 2018-07-19 | 2026-10-02 |
| CVE-2020-12812 Fortinet FortiOS SSL VPN Improper Authentication Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiOS | 2020-07-24 | 2026-10-02 |
| CVE-2026-104610 A security vulnerability has been detected in Tenda HG7, HG9 and HG10 300001138_... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104611 A vulnerability was detected in Tenda AC9 15.03.02.13. |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-84436 IBM Guardium Data Protection 12.2 is vulnerable to command injection in the cert... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-09-29 | 2026-10-02 |
| CVE-2026-53988 Dockhand before 1.0.40 contains an authentication bypass vulnerability in its gi... |
critical | 10.0 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-51872 Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51867 agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/ap... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51861 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/bac... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-51857 In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can ru... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102792 A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2018-19949 QNAP NAS File Station Command Injection Vulnerability |
critical | 9.8 | Listed | QNAP / Network Attached Storage (NAS) | 2020-10-28 | 2026-10-02 |
| CVE-2024-13994 Nagios XI versions prior to 2024R1.1.2 contain a missing authorization control w... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-13996 Nagios XI versions prior to 2024R1.1.3 did not invalidate all other active sessi... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-13999 Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose th... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2024-14003 Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RC... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-02 |
| CVE-2019-2725 Oracle WebLogic Server, Injection |
critical | 9.8 | Listed | Oracle / WebLogic Server | 2019-04-26 | 2026-10-01 |
| CVE-2018-19323 GIGABYTE Multiple Products Privilege Escalation Vulnerability |
critical | 9.8 | Listed | GIGABYTE / Multiple Products | 2018-12-21 | 2026-10-01 |
| CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver. |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer ove... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103752 Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62071 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56660 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103255 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
critical | 9.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2020-0796 Microsoft SMBv3 Remote Code Execution Vulnerability |
critical | 10.0 | Listed | Microsoft / SMBv3 | 2020-03-12 | 2026-10-01 |
| CVE-2016-1019 Adobe Flash Player Arbitrary Code Execution Vulnerability |
critical | 9.8 | Listed | Adobe / Flash Player | 2016-04-07 | 2026-10-01 |
| CVE-2012-1710 Oracle Fusion Middleware Unspecified Vulnerability |
critical | 9.8 | Listed | Oracle / Fusion Middleware | 2012-05-03 | 2026-10-01 |
| CVE-2026-92173 Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be indu... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51870 DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/she... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51859 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in sa... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51864 DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (pac... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103044 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundat... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-100240 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Template... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.