October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105697 Langflow is a tool for building and deploying AI-powered agents and workflows. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-09 |
| CVE-2026-105740 Langflow is a tool for building and deploying AI-powered agents and workflows. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105691 Penpot is an open-source design and prototyping platform. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97283 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanc... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88424 FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the f... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105638 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105639 Plane is an open-source project management tool. |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105640 Plane is an open-source project management tool. |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105641 Plane is an open-source project management tool. |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105636 Plane is an open-source project management tool. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105637 Plane is an open-source project management tool. |
critical | 9.6 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104711 Improper neutralization of special elements used in an expression language state... |
critical | 9.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-103352 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88393 WookTeam v1.6.6 and before is vulnerable to RCE in the project task export inter... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88395 GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbis... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-37719 An issue in dormakaba evolo Service (all versions) allows a remote attacker to e... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joom... |
critical | 9.8 | — | Ordasoft / joomla cck | 2026-10-05 | 2026-10-14 |
| CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and... |
critical | 9.8 | — | Techfry / tf content | 2026-10-05 | 2026-10-14 |
| CVE-2026-79820 A remote user validation failure vulnerability exists in HPE Integrated Lights-O... |
critical | 9.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-88391 Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables th... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105285 A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1... |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105284 A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2017-20285 YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTRO... |
critical | 9.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105209 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains an improper authorizati... |
critical | 9.6 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105215 ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in... |
critical | 9.1 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105207 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user... |
critical | 9.8 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-103355 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability |
critical | 10.0 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-105135 A vulnerability has been found in InternLM MindSearch 0.1.0. |
critical | 10.0 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-105105 CWE-306: Missing Authentication for Critical Function in the ait.core.server tel... |
critical | 9.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92084 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-87115 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105080 In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, an... |
critical | 9.9 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-84411 The web management service in affected RouterOS versions contains an integer und... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-95102 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82041 UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMInc... |
critical | 9.9 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-82042 UTMStack before 11.2.16 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104019 OS command injection in the Studio Space startup validation script in Amazon Sag... |
critical | 9.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103956 Missing authentication for critical function in the authentication dependency in... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2023-54405 H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud plat... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.