October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104817 Misskey is an open source, federated social media platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103937 Misskey is an open source, federated social media platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105445 An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organ... |
not reported | — | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-104011 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-66057 Frappe is a full-stack web application framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-55823 Frappe is a full-stack web application framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-53562 Improper link resolution before file access ('link following') vulnerability in... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-88836 Rejected reason: Red Hat Product Security determined this is not a security vuln... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69150 KeePassXC is a cross-platform community-driven port of the Windows application K... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54697 ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KState... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54700 ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KState... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102982 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103928 Metabase is an open source business intelligence and analytics platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-101899 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-97333 QAPI contained a stack-based buffer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97334 The network messaging layer contained improper handling of highly compressed dat... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77093 CvFWD contained an integer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77094 CvFWD contained an out-of-bounds write affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77095 CvFWD contained a null pointer dereference affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77096 CVFS contained a missing authentication condition affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77099 CVFS contained an input validation issue affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77100 MediaAgent contained a heap-based buffer overflow issue affecting service availa... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77090 CVFS contained an XML external entity (XXE) reference handling issue affecting i... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53711 MCP Context Forge provides an MCP Admin UI for managing gateway resources. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-18228 HyperScale contained a path traversal issue affecting information disclosure. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-4869 A potential privilege escalation issue was identified in InstallShield version 2... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-12655 A security issue exists within 1732E ArmorBlock® I/O, where an unauthenticated a... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-12656 A denial-of-service security issue exists in the affected product and version. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106108 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102603 Gotify server is a simple server for sending and receiving messages in real-time... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102250 CWE-345: Insufficient Verification of Data Authenticity vulnerability exists tha... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58771 AMI APTIOV contains vulnerabilities in BIOS
where users may cause “Integer Overf... |
not reported | — | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2025-58772 AMI APTIOV contains vulnerabilities in BIOS where users may cause
“Classic Buff... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58773 AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2025-58774 AMI APTIOV contains vulnerabilities
in BIOS where users may cause “Buffer Access... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-0893 AMI APTIOV contains a vulnerability in BIOS
where an attacker may cause “Exposur... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-63316 A SQL injection vulnerability has been identified in Payload CMS. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109162 Forms using FileUpload or ImageUpload elements with a custom saveToFileMount con... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-96535 Cross-Site Scripting on the YouMind portal, specifically in the avatar update en... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-75826 Command injection in the backup function in Teltonika Networks RUTOS 7.22 before... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.