October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (382), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85949 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-85950 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.4 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85951 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85952 Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85953 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85954 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109398 Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109399 SWUpdate through 2026.05.1 contains an improper certificate validation vulnerabi... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109391 Square Squash through commit e73f280 contains an insecure deserialization vulner... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109394 Thirty bees through 1.7.0 contains an authentication bypass vulnerability in Pas... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-107248 Thelia 3.0.0's back-office Email/Messages feature contains a server‑side templat... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108899 A flaw has been found in tobychui zoraxy up to 3.3.4. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108900 A vulnerability has been found in Exponent CMS up to 3.0.2patch2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108906 A vulnerability has been found in Netcore NR268 1.7.121109. |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108094 A use-after-free flaw was found in mutter in the Wayland color-management ICC im... |
high | 7.8 | — | — | 2026-10-12 | 2026-11-04 |
| CVE-2026-103535 Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of exe... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109228 SGLang through 0.5.21 contains a resource budget bypass vulnerability that allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109229 SGLang through 0.5.21 contains a denial of service vulnerability that disables P... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-12613 Deserialization of untrusted data vulnerability in Ministry of Justice General D... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18390 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109205 LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109225 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109226 SGLang through 0.5.21 contains a decompression amplification vulnerability in lo... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109227 SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in p... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109199 LogicalDOC Community Edition through 9.3 contains a code injection vulnerability... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-109201 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-93695 In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyServic... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109186 jshERP through 3.6 contains a mass assignment vulnerability in the UserControlle... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-52903 A deserialization of untrusted data vulnerability was found in ManageIQ. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109185 jshERP through 3.6 contains a missing authorization vulnerability in the UserCon... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108953 mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that a... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109164 TDuck survey form through 6.0 contains an insecure direct object reference vulne... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-108836 A vulnerability has been found in Ollama up to 0.34.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-105410 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105411 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105412 An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could al... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108826 A vulnerability was found in Zen Cart up to 2.2.2. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.