October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,572
Critical
3,295
High
7,971
Medium
7,638
Low
740
Severity not reported
4,928
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77924 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65685 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65686 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77215 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77216 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-36698 Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and e... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-3322 Due to improper permission checks in Lobster_pro, attackers are able to interact... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106676 qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImp... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106677 Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116596 Pyrus Sync for Windows contains a local privilege escalation vulnerability cause... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113877 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115897 Serialize JavaScript serializes JavaScript values to a superset of JSON that inc... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Conten... |
not reported | — | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115825 HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to cra... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-96432 A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_S... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107157 Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111590 A wide range of Harbor versions allow SSRF via its webhook delivery component wh... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107090 An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115905 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-71455 Cleartext storage of sensitive information in memory vulnerability in Johnson Co... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-71456 Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech En... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115883 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistenc... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-111074 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerabl... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111075 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to per... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-110938 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable t... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-93328 Path Traversal and Missing Authorization in cloud-storage source in Google Cloud... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77054 boneIO Black stores passwords, including the MQTT broker and web panel passwords... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77056 boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77058 boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-cha... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110845 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a code... |
not reported | — | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-115817 Starman versions before 0.4019 for Perl allow a stalled request body to hold a w... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115822 Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests,... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115824 Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded bu... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116372 MISP mispguard is a security filtering proxy that inspects and blocks MISP feed... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77052 boneIO Black exposes a Node-RED instance without authentication at the /nodered/... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77053 boneIO Black firmware ships with authentication disabled by default. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77055 boneIO black_debian_images gives the boneio service account excessive privileges... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77057 boneIO Black does not limit authentication attempts on its web interface (POST /... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77059 boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.