October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109698 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109892 Incorrect Privilege Assignment vulnerability in Shabti Kaplan Frontend Admin by... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109686 Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109688 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109694 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108497 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109145 The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a de... |
critical | 9.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocat... |
critical | 9.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-108587 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110911 Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted valu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110862 Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vu... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55680 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55683 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55684 WeGIA is a web manager for charitable institutions. |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-85714 Stirling-PDF is a locally hosted web application that facilitates various operat... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110536 A vulnerability was determined in D-Link DIR-868L 2.01b05. |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55573 e107 is a content management system (CMS). |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55572 e107 is a content management system (CMS). |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-108390 Hestia Control Panel is a lightweight and powerful control panel for the modern... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101982 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101983 A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101954 An Improper Authentication vulnerability in the J-Web management interface and i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-77524 KEDA is a Kubernetes-based Event Driven Autoscaling component. |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-10-14 | 2026-10-15 |
| CVE-2026-33796 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33792 A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Net... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109439 Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 cont... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102182 A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-102175 A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102178 A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102031 An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101990 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | Juniper / junos os evolved | 2026-10-14 | 2026-10-30 |
| CVE-2026-101980 An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS wi... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101986 An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS a... |
critical | 9.8 | — | Juniper / junos os evolved | 2026-10-14 | 2026-10-30 |
| CVE-2026-101956 An Improper Authentication vulnerability in the J-Web web management component o... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101950 A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-91881 Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improp... |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89068 Missing critical step in authentication vulnerability in Progress MOVEit Transfe... |
critical | 9.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.