October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,598
Critical
3,298
High
7,980
Medium
7,645
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117618 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for cre... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117619 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117620 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117621 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117622 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send excepti... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text show... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file pa... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83525 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka fr... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWaylan... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86983 A remote attacker may be able to terminate a process that passes attacker-contro... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113957 An attacker who controls the registry, a mirror, or the network path to it may b... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-92152 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
not reported | — | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-57209 Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55826 The GTM Server Side plugin by stape.io implements server-side tracking on WordPr... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-86055 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-43840 A NULL pointer dereference vulnerability in the license manager service could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-114608 Pylint is a static code analyser for Python. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-108359 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-93857 A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-93864 A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allow... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-93865 A missing authentication vulnerability in the Fireware OS FireCluster synchroniz... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-91093 A potential security vulnerability has been identified in HP One Agent for certa... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-90465 A missing authentication vulnerability in the FireCluster Sync processing allows... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-103593 A stack-based buffer overflow vulnerability in the Fireware OS logging service a... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102815 An
operating-system command injection vulnerability exists in the tmpServer
serv... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102814 An
authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE30... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-117174 Rejected reason: VUL-2026-008368 為先回報之相同問題 |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86018 Part-DB is an open source inventory management system for electronic components. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57210 Heimdall is a cloud native Identity Aware Proxy and Access Control Decision serv... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-93862 An out-of-bounds read vulnerability in the FireCluster Sync processing allows an... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-57184 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-55561 InvoicePlane is a self-hosted open source application for managing invoices, cli... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111478 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111486 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111575 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-77468 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-4950 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-4951 The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem all... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.