October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerabilit... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109573 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escap... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2025-71432 Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-102627 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2024-58390 Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege man... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-27 |
| CVE-2026-84312 Nginx UI is a web user interface for the Nginx web server. |
high | 7.1 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-90911 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90912 IBM Maximo AI Service 9.1.0, and 9.2.0 SaaS could allow a remote attacker to cau... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-90921 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-92876 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96264 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96265 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96266 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96261 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96262 IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerab... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-96263 IBM Power Systems Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84316 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84317 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84318 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84319 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84360 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-75881 IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-78673 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84313 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-84315 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-53997 Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18517 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109567 Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management v... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109568 Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in t... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109569 sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109559 EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass t... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109560 Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vuln... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109563 N3.js before 2.11.1 contains a regular expression denial of service vulnerabilit... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109380 modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109426 Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that a... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109556 EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnera... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109557 EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.