October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109558 EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerabil... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105052 IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2021-48012 fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2020-37279 easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerabilit... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2020-37280 cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.dec... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2021-48011 Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-95837 containerd is an open-source container runtime. |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-41510 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109422 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109423 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57143 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59976 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-59977 ConvertX is a self-hosted file conversion service. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65954 PHPCSUtils is a suite of utility functions for use with PHP_CodeSniffer. |
high | 8.6 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-83535 A flaw was found in openstack-network-exporter. |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108921 A vulnerability was detected in KusalkaSilva Learning-Management-System up to ff... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-18166 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105464 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Win... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105465 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-77363 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108479 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108481 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108916 A vulnerability was found in Edimax BR-6208AC 1.32. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85973 Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transpor... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85974 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85975 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85965 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85966 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85968 Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85969 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85970 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85972 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85958 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85959 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85960 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85961 On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85962 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85964 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.