October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109740 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 compone... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109157 A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported t... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contai... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63350 Affected devices do not properly restrict executable content contained in import... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89309 The authorization middleware of the WMS MobileServer
fails to require authentica... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109110 A flaw has been found in Wavlink WL-WN592AX6 250422. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109109 A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109108 A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108971 A flaw has been found in D-Link DCS-930L B1.08B4. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 10.0 | Listed | Gitlab / gitlab | 2026-10-13 | 2026-11-02 |
| CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential st... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validat... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks i... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89111 The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul... |
critical | 10.0 | — | — | 2026-10-13 | 2026-11-03 |
| CVE-2026-96119 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta... |
critical | 9.9 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-82110 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-82101 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-19622 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass auth... |
critical | 9.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-90920 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-92116 OAuth1 callback validation vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92119 REST API Mass Assignment vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92120 OAuth1 Request Replay Attack vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109566 Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-108929 A flaw has been found in Netcore NR268 1.7.121109. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2025-71429 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-96012 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109575 In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edit... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-87744 A flaw was found in Quarkus REST Data Panache. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57118 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-77366 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108917 A vulnerability was determined in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108918 A vulnerability was identified in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108915 A vulnerability has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.