October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108966 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108967 A security flaw has been discovered in SourceCodester Performance Indicator Syst... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108965 A vulnerability was determined in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108964 A vulnerability was found in SourceCodester Performance Indicator System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-92883 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
high | 8.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-96893 GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 bef... |
high | 7.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-35001 OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-81839 GitLab has remediated an issue in GitLab EE affecting all versions from 18.1 bef... |
high | 7.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-14814 GitLab has remediated an issue in GitLab CE/EE affecting all versions before 19.... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-16301 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7... |
high | 8.5 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-108956 A vulnerability was identified in code-projects Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-89113 SAP Commerce Cloud does not sufficiently validate certain user-supplied input be... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89120 A regression caused by an API change in SAP ABAP Platform reintroduces a previou... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-58249 SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-81858 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to caus... |
high | 8.1 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-84418 IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attack... |
high | 7.4 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-85457 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-93891 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93892 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-82108 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-82096 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
high | 8.8 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-75782 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker t... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75061 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse di... |
high | 7.5 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-75095 IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-19627 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitr... |
high | 8.2 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-17475 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 7.1 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-19620 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauth... |
high | 8.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-109673 Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109667 Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege esca... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109671 Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109652 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side te... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109653 Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109640 Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability tha... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109633 Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a stored cross-s... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109617 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109612 Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109613 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109616 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109604 Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-s... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109608 Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.