October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,517
Critical
3,162
High
7,208
Medium
7,048
Low
637
Severity not reported
4,462
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105694 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105743 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.8 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-105705 A security flaw has been discovered in SourceCodester Drug Recommendation System... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105447 A flaw was found in Quay. |
medium | 5.5 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105472 A weakness has been identified in girishsaraf Online-Appointment-Booking-System... |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-104044 A flaw was found in sssd. |
medium | 6.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-104035 A flaw was found in SSSD. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-95386 TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95388 Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of serv... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95390 PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95391 ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95392 MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denia... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95393 CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95394 Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to... |
medium | 4.7 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-95395 IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-105753 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105755 vLLM is an inference and serving engine for large language models. |
medium | 4.2 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105756 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105757 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-106222 Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed... |
medium | 5.9 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-93679 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 4.3 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97671 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
medium | 6.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-106223 Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059... |
medium | 4.7 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-75806 Issue summary: An established DTLS 1.2 association using an AEAD cipher suite
ca... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75805 Issue summary: A CMP client that requests certificate revocation on the basis
of... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-75804 Issue summary: OpenSSL QUIC stack does not enforce connection
level flow control... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-42772 Issue summary: The QUIC stream reassembly algorithm performance deteriorates
pro... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-35189 Issue summary: A certificate with many nameRelativeToCRLIssuer CRL
distribution... |
medium | 5.3 | — | Openssl / openssl | 2026-09-29 | 2026-10-08 |
| CVE-2026-96418 TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allo... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96417 RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows deni... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96416 IEEE 802.11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allow... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-96415 Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18... |
medium | 5.5 | — | Wireshark / wireshark | 2026-09-29 | 2026-10-08 |
| CVE-2026-107271 Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows un... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107166 A weakness has been identified in Open5GS up to 2.7.7. |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105646 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105678 Ghost is a Node.js content management system. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105389 A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-97626 Requesting a user or organization profile page (`GET /{username}`) with an `Acce... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-88514 An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensiti... |
medium | 5.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-71299 A flaw was found in Maestro. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.