October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75345 OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-75346 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and mast... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75348 An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and mast... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-75349 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bound... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107813 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107814 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-108113 ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerab... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107807 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107809 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107810 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107811 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107812 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-104084 SmarterMail before build 9777 contains a privilege escalation vulnerability wher... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-104082 SmarterMail before build 9777 contains a remote code execution vulnerability tha... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-78795 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-33367 SNMP can be used to perform administrative actions such as retrieving configurat... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-39453 Navigating to a certain URL on the switch’s web server causes the switch to rebo... |
high | 8.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-39460 Usernames and passwords, including the default factory credentials, are stored i... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-28745 Usernames and passwords, including the default credentials, are stored in the co... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-29797 No authentication is required when updating firmware or bootloader, making it ea... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108106 Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108108 PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107806 Nginx UI is a web user interface for the Nginx web server. |
high | 7.2 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-108101 HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulne... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107805 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-104081 KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94067 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94064 Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Sho... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94065 Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio color... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-62026 Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104629 A component loading mechanism in openPDC and openHistorian will construct and ru... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105281 The internal data publisher on openPDC accepts network connections without authe... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94061 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94062 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94058 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94059 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94060 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.