October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,598
Critical
3,298
High
7,980
Medium
7,645
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic r... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116134 HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-T... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous mu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded mul... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116267 MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via un... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename w... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created outpu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate bou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of messag... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic r... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in ch... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backt... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117501 HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounde... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116797 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118242 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118243 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118246 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118247 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118250 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118251 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118254 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118255 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundle... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbear... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111108 Apache Kafka's code-generated protocol readers pre-size an array's collection fr... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111115 Apache Kafka's code-generated readers for flexible protocol versions read a tagg... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111496 Kafka Streams derives its stream-time clock from record timestamps. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111551 Several Kafka deserialization paths read a size or count field from input data a... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-112375 An authenticated Kafka principal with no authorization grants (not even ALTER_CO... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115644 Apache Kafka Connect contains an authentication bypass vulnerability affecting t... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117612 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserializ... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117613 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117614 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117615 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when c... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117616 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint tha... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117617 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.