October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83525 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka fr... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWaylan... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86983 A remote attacker may be able to terminate a process that passes attacker-contro... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113957 An attacker who controls the registry, a mirror, or the network path to it may b... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-92152 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
not reported | — | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-57209 Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55826 The GTM Server Side plugin by stape.io implements server-side tracking on WordPr... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-43840 A NULL pointer dereference vulnerability in the license manager service could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-114608 Pylint is a static code analyser for Python. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-108359 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-93857 A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-93864 A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allow... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-93865 A missing authentication vulnerability in the Fireware OS FireCluster synchroniz... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-91093 A potential security vulnerability has been identified in HP One Agent for certa... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-90465 A missing authentication vulnerability in the FireCluster Sync processing allows... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-103593 A stack-based buffer overflow vulnerability in the Fireware OS logging service a... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102815 An
operating-system command injection vulnerability exists in the tmpServer
serv... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102814 An
authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE30... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117174 Rejected reason: VUL-2026-008368 為先回報之相同問題 |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86018 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57210 Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-93862 An out-of-bounds read vulnerability in the FireCluster Sync processing allows an... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-57184 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-111478 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111486 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111575 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-77468 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-4950 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4951 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4952 The "ASMobile" web interface, which is part of the VertiGIS software package "GI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114355 OS command injection in the root-privileged 'hardware_monitor' helper in DJI Cry... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114356 Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114357 Missing authentication for a critical function in the Android Debug Bridge daemo... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-112188 MISP contains a vulnerability in its server settings lookup mechanism that allow... |
not reported | — | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-114353 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant'... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114354 Missing authorization in the native binder service 'android.dji.server' (transac... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30049 The CGM CLININET application stores user passwords as unsalted MD5 hashes. |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30050 CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which d... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2025-30051 The CGM CLININET application stores the production database login and password,... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.