October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100205 Untrusted pointer dereference in SysInternals allows an authorized attacker to e... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100207 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-100209 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100210 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100200 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100201 Heap-based buffer overflow in Windows Client License Service allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108379 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108380 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108381 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108382 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108383 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108384 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108385 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108375 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108376 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108377 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108378 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Inje... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-23 |
| CVE-2026-104085 odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerabi... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2025-46773 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-82416 FrankenPHP is a modern application server for PHP. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85990 Leantime is an open source project management system. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-61642 Squid is a caching proxy for the Web. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54640 OpenRemote is an open-source internet-of-things platform. |
high | 7.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54641 OpenRemote is an open-source internet-of-things platform. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110128 fuint through commit 4c4bc8a contains a missing authentication vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110124 FastBee through 2.1.0 contains an insecure direct object reference vulnerability... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110119 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110123 Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerabi... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110115 Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal v... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110108 MateCloud through 5.0.8 contains a missing authorization vulnerability that allo... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110097 Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110102 Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109620 A vulnerability has been found in SourceCodester Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109606 A vulnerability was detected in SourceCodester Art Gallery Management System 1.0... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109607 A flaw has been found in SourceCodester Online Exam System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xt... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.