October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (300), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104385 Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105807 A vulnerability was found in SourceCodester Simple Student Information System 1.... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-57559 Memory corruption while processing service requests. |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25302 Cryptographic Issue when processing non-ELF partitions, authentication and signa... |
high | 7.1 | — | Qualcomm / xrv9209 firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57537 Memory Corruption when accessing and modifying geographic mapping data concurren... |
high | 7.8 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57545 Memory corruption when processing draw objects of incorrect type during graphics... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57546 Transient DOS when processing a continuous receive command with a zero-sized glo... |
high | 7.5 | — | Qualcomm / congo firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57554 Memory Corruption when asynchronous threads access shared performance counter da... |
high | 7.8 | — | Qualcomm / snapdragon g1 gen 2 gaming platform firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-57555 Memory Corruption when executing system service routines due to improper handlin... |
high | 7.8 | — | Qualcomm / cologne firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-25291 Memory corruption when performing concurrent operations on shared memory page li... |
high | 7.8 | — | Qualcomm / sar1165p firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-105701 The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution i... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105776 A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-We... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-25267 Memory corruption when non-secure loader rewrites page tables before secure memo... |
high | 7.8 | — | Qualcomm / qca6698au firmware | 2026-10-06 | 2026-10-09 |
| CVE-2026-39760 Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions. |
high | 7.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39789 Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41558 Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41563 Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75962 The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs,... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-39723 Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105072 Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105704 A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105486 A vulnerability was detected in OSSRS srs up to 7.0-a1. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105571 A flaw has been found in PickMall Lilishop up to 4.2.4. |
high | 7.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-82988 There exists an arbitrary file download in vCast APK delivery mechanism in ViewS... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105762 Dify is an open-source LLM app development platform. |
high | 8.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105782 Scrapy is a high-level web crawling and scraping framework for Python. |
high | 7.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105783 Joplin is an open source note-taking and to-do application that organises notes... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105471 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105761 Dify is an open-source LLM app development platform. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105759 vLLM is an inference and serving engine for large language models. |
high | 7.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-16 |
| CVE-2026-105469 A vulnerability was determined in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105470 A vulnerability was identified in girishsaraf Online-Appointment-Booking-System... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties... |
high | 7.5 | Listed | Atlassian / Multiple Products | 2026-10-05 | 2026-10-29 |
| CVE-2026-105750 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105751 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.5 | — | Docling / docling | 2026-10-05 | 2026-10-16 |
| CVE-2026-105744 Docling simplifies document processing by parsing diverse formats and providing... |
high | 8.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105745 Docling simplifies document processing by parsing diverse formats and providing... |
high | 7.8 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105468 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-77226 Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105773 Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalat... |
high | 7.0 | — | — | 2026-10-05 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.