October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (286), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103903 An incorrect authorization vulnerability in the WinBox
authentication flow of Mi... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105407 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105408 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105409 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103902 Improper verification of cryptographic signature vulnerability in DigiDoc libdig... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108819 A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108818 A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-78355 A path traversal vulnerability in the OTRS SendSupportBundle functionality allow... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108807 A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d2... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-98385 In the Linux kernel, the following vulnerability has been resolved:
sched/cache... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2026-108805 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108806 A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-87690 The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is a... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108799 A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d1... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108798 A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108985 ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108980 Blinko through 1.8.8 allows directory traversal, overwriting startup files as ro... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108783 A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108976 GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via... |
high | 7.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain c... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-19935 The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) da... |
high | 7.5 | — | — | 2026-10-11 | 2026-11-04 |
| CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's lin... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-19669 The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_ga... |
high | 7.8 | — | — | 2026-10-11 | 2026-11-04 |
| CVE-2026-19736 The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed t... |
high | 7.8 | — | — | 2026-10-11 | 2026-11-04 |
| CVE-2026-108913 omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-pa... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108902 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulne... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108905 pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key v... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108863 Katanemo Plano through 0.4.37 contains a missing authentication vulnerability th... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108865 AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that... |
high | 8.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108859 mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTT... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108853 UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnera... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108758 Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability i... |
high | 8.2 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108760 LlamaFarm through 0.0.34 contains an insecure default configuration that binds i... |
high | 7.6 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108746 Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108739 OpenAgents Workspace backend through launcher-v1.0.17 contains an information di... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108740 GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulner... |
high | 8.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108744 pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in... |
high | 7.0 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108718 Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-108714 MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnera... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108571 A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. |
high | 7.3 | — | — | 2026-10-11 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.