October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,543
Critical
3,166
High
7,218
Medium
7,051
Low
637
Severity not reported
4,471
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118173 MISP Guard, a proxy that enforces security policies on MISP feed data, contained... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-78661 When coalescing adjacent text nodes in addText and fosterParent, appending to an... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-97045 In childTextNodesAreLiteral, walking up the tree previously stopped at the neare... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-22063 The private keys of eight eMudhra intermediate CA certificates have been comprom... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-101272 The mechanism binding files generated during a shredding process to the authenti... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101273 Some of our API endpoints allowed to create order payments referencing a gift ca... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-101274 When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105420 Wing FTP Server does not verify user's base folder. |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116078 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cau... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-108014 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108015 Private keys for eight eMudhra intermediate CA certificates have been compromise... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118131 GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discre... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115522 Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93517 A heap buffer overflow in handling GLX
RenderLarge request where dataBytes excee... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112945 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-111762 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-104383 Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquil... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104384 Insufficiently Protected Credentials in tunnel gateway and provisioning interfac... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102790 Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations exp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102812 A hard-coded
cryptographic key vulnerability exists in the user-configuration ba... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102816 An authorization vulnerability exists in the country or region configuration int... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-64394 A vulnerability allowing a low-privileged local user to write arbitrary files wi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject S... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106077 A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administ... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106078 A vulnerability allowing an unauthenticated attacker to bypass REST API authenti... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to byp... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108140 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108141 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-14571 A Blind SQL Injection vulnerability in Futurum Software’s management software, c... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112197 Vulnerability due to a lack of authentication in critical functions of the NoviG... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112198 XML External Entity (XXE) injection vulnerability in the SAFT import feature of... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118174 When a message containing an OpenPGP key attachment was displayed, Thunderbird a... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunder... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.