October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55695 FearlessCMS is a flat-file content management system centered on simplicity and... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78802 An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-55675 The Salty documentation repository builds and deploys the docs.saltbox.dev websi... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2024-34323 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-28 |
| CVE-2024-34320 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect acces... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-53709 MCP Context Forge is an MCP gateway and administrative platform. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104192 Dragonfly is an in-memory data store built for modern application workloads. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-107460 Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-74043 Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-74040 Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-65173 NVIDIA AIStore for Linux contains a missing authentication vulnerability in the... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65162 NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes P... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109772 Same-origin policy bypass in the DevTools component. |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109774 Invalid pointer, undefined behavior in the DOM: Notifications component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109780 Mitigation bypass in the DOM: Core & HTML component. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109755 Sandbox escape in the DOM: Content Processes component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109740 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109157 A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported t... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contai... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63350 Affected devices do not properly restrict executable content contained in import... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89309 The authorization middleware of the WMS MobileServer
fails to require authentica... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109110 A flaw has been found in Wavlink WL-WN592AX6 250422. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109109 A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109108 A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108971 A flaw has been found in D-Link DCS-930L B1.08B4. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 10.0 | Listed | Gitlab / gitlab | 2026-10-13 | 2026-11-02 |
| CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential st... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validat... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks i... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89111 The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul... |
critical | 10.0 | — | — | 2026-10-13 | 2026-11-03 |
| CVE-2026-96119 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta... |
critical | 9.9 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.