October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106578 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 8.2 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106573 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106576 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106565 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-106567 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-77214 libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in... |
high | 8.2 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-46570 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_dow... |
high | 8.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-106558 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-106510 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-106556 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage | 2026-10-07 | 2026-10-13 |
| CVE-2025-70522 The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70517 The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-46572 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail()... |
high | 7.4 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-46434 wger is a free, open-source workout and fitness manager. |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-46569 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail()... |
high | 7.7 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-09 |
| CVE-2026-107183 llama.cpp before b11393 contains a use-after-free and double free vulnerability... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42616 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c... |
high | 7.8 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-19 |
| CVE-2026-42617 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in... |
high | 7.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-42618 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() i... |
high | 7.1 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-08 |
| CVE-2026-43976 wger is a free, open-source workout and fitness manager. |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107181 Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnera... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102257 A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-98374 In the Linux kernel, the following vulnerability has been resolved:
tcp: fix us... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-24 |
| CVE-2026-102256 Post-authentication Improper Neutralization of Special Elements used in an OS Co... |
high | 7.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-106059 GitAhead through 2.7.1 on macOS contains a command injection vulnerability that... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-42708 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42710 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106056 Rundeck before 6.2.0 contains an OS command injection vulnerability that allows... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106057 patool before 4.0.6 contains an OS command injection vulnerability on Windows be... |
high | 7.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106058 GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42713 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42714 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103668 An SQL Injection vulnerability exists in the Site Search function of Movable Typ... |
high | 8.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42720 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-42721 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-15894 The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/blueto... |
high | 8.8 | — | — | 2026-10-07 | 2026-11-04 |
| CVE-2026-19186 ieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c... |
high | 8.1 | — | — | 2026-10-07 | 2026-11-04 |
| CVE-2026-89417 The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.