October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (300), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105741 Langflow is a tool for building and deploying AI-powered agents and workflows. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102262 Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-95263 Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95265 Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in t... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97257 Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Plan... |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93617 Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Ca... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78860 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78861 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105679 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105651 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105675 Ghost is a Node.js content management system. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105677 Ghost is a Node.js content management system. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105649 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105650 Ghost is a Node.js content management system. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105392 A vulnerability has been found in Lybbn Django-Vue-Lyadmin up to 3.2.12. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103066 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103348 Deserialization of Untrusted Data vulnerability in Smackcoders Inc. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100511 Deserialization of Untrusted Data vulnerability in Vektor Inc. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100506 Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97303 Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Co... |
high | 7.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-58859 In multiple places, there is a possible denial of service due to an uncaught exc... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58865 In multiple functions of PduParser.java, there is a possible persistent denial o... |
high | 7.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58880 In handle_app_val_response of btif_rc.cc, there is a possible way to achieve cod... |
high | 7.0 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55270 In dialInternal in multiple locations, there is a possible permission bypass due... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55280 In multiple locations, there is a possible out-of-bounds write due to uninitiali... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55286 In stpropnci_process of stpropnci.cc, there is a possible out of bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58815 In multiple locations, there is a possible out of bounds write due to an incorre... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58835 In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58841 In multiple functions of VirtualAudioControllerTest.java, there is a possible pe... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-58854 In multiple locations, there is a possible memory corruption due to type confusi... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55266 In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write du... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55269 In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety is... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49937 In multiple functions of MessageQueueBase.h, there is a possible out of bounds r... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28641 In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28647 In updateState of DeviceAdminAppsPreferenceController.java, there is a possible... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28648 In Settings, there is a possible permission bypass due to a confused deputy. |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-45524 In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due... |
high | 8.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49878 In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out... |
high | 7.2 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49880 In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds wri... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-49885 In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.