October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (300), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-49933 In handle_le_monitor_device_event of msft.cc, there is a possible control-flow h... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28625 In multiple locations, there is a possible permission bypass due to a logic erro... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28640 In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java,... |
high | 7.8 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-105642 Ghost is a Node.js content management system. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105643 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105634 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105635 Plane is an open-source project management tool. |
high | 7.4 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105386 A vulnerability was identified in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105387 A security flaw has been discovered in girishsaraf Online-Appointment-Booking-Sy... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts. |
high | 7.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-103334 Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web De... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103349 Deserialization of Untrusted Data vulnerability in Rymera Web Co Product Feed PR... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100515 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105629 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105630 Plane is an open-source project management tool. |
high | 8.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105631 Plane is an open-source project management tool. |
high | 7.5 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105633 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105384 A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105385 A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105628 Plane is an open-source project management tool. |
high | 7.6 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104977 Plane is an open-source project management tool. |
high | 7.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104978 Plane is an open-source project management tool. |
high | 8.2 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104979 Plane is an open-source project management tool. |
high | 8.7 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104971 Plane is an open-source project management tool. |
high | 8.5 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104973 Plane is an open-source project management tool. |
high | 7.6 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104974 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104975 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104905 FacturaScripts before version 2026.7 contains a PHP object injection vulnerabili... |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-101919 A flaw was found in the HyperShift operator. |
high | 8.8 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2025-15643 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-14 |
| CVE-2026-105382 A flaw has been found in onetwothreeneth HospitalManagementSystem up to 9ef91ed6... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105383 A vulnerability has been found in onetwothreeneth HospitalManagementSystem up to... |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-12171 auto-changelog before 2.6.1 merges configuration from inside the target reposito... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104970 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102779 Joomla Extension - joomlafry.com - Unauthenticated forced execution of published... |
high | 7.3 | — | Techfry / tf content | 2026-10-05 | 2026-10-16 |
| CVE-2026-102282 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node... |
high | 7.1 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-88396 ApiAdmin v5.0 and before is vulnerable to Directory Traversal. |
high | 7.2 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104890 Kunstmaan CMS is an open source content management system based on the Symfony f... |
high | 7.2 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-104891 mppx-condition-gate provides conditional free-access wrappers for mppx payment m... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.