October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91882 Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Inser... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfe... |
high | 7.5 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certif... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Trans... |
high | 7.3 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-16 |
| CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progre... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-53615 util-linux is a random collection of Linux utilities. |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53614 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103929 mise manages dev tools like node, python, cmake, and terraform. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102695 OmniFaces is a utility library for Faces. |
high | 8.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_modul... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91184 Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.b... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94197 An authentication and authorization bypass vulnerability exists in F5 NGINX Kube... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-73800 Gitea resolves local reusable workflow files from a fork's head commit when a tr... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job contai... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73804 Gitea allows a token with write:user scope to register an attacker-controlled SS... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrol... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73539 Gitea substitutes a URL derived from the markup Context field into external rend... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-71184 Gitea's pull request review notifier does not attach the pull request to the Act... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-66877 Gitea enforces first-time fork contributor approval by blocking jobs, but some j... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-53612 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53613 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is co... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110646 Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vuln... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110647 Turnpress through 0.4.2 contains an OS command injection vulnerability that allo... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110648 @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerab... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 contains an OS command injection vul... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110642 xhtml2pdf before 0.2.19 contains an OS command injection vulnerability in pisa.s... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110632 Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC servic... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110633 MyReport Updater through 2.1.1 contains a local privilege escalation vulnerabili... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110637 buildebooks before 0.2.2 contains an OS command injection vulnerability in lib/k... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110628 Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110618 SmsForwarder through 3.5.0 contains a missing authentication vulnerability in it... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110621 Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in Pro... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110622 Papermerge Core through 3.5.3 contains a missing authorization vulnerability tha... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.