October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,572
Critical
3,295
High
7,971
Medium
7,638
Low
740
Severity not reported
4,928
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-77060 boneIO black_debian_images stores the Mosquitto MQTT broker password file at /et... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77061 boneIO Black directly excludes several API endpoints from the authentication. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-77062 The boneIO Black web interface lacks proper clickjacking protections. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116184 OpenRemote before 1.31.0 contains an authorization bypass vulnerability that all... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-108525 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108529 Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-109584 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110314 Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket c... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110499 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111101 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111103 Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtru... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112880 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Respons... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113436 Inefficient Algorithmic Complexity vulnerability in the header integer parser of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113440 Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114213 Allocation of Resources Without Limits or Throttling vulnerability in the WebSoc... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114216 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115269 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115693 Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115700 Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows S... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-97200 Allocation of Resources Without Limits or Throttling vulnerability in hackney_co... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110748 This issue affects Apache SIS from version 0.7 through 1.6 inclusive. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113951 If an attacker can write to the filesystem of a container k8s cluster container,... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-85297 Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Clou... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65202 Rejected reason: The reported issue was assessed as intended functionality. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65203 Rejected reason: The reported issue could not be reproduced. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65212 Rejected reason: The reported issue was assessed as intended functionality. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65214 Rejected reason: The reported issue is tracked under CVE-2026-18449. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65215 Rejected reason: The reported issue could not be reproduced. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65216 Rejected reason: The reported issue is tracked under CVE-2026-18450. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65217 Rejected reason: The reported issue could not be reproduced. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65218 Rejected reason: The reported issue is tracked under CVE-2026-18451. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65221 Rejected reason: The reported issue was assessed as intended functionality. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65222 Rejected reason: The reported issue could not be reproduced, and the affected pr... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65226 Rejected reason: This CVE ID has been rejected by runZero as unused. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-99092 In the Linux kernel, the following vulnerability has been resolved:
riscv: patc... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-99093 In the Linux kernel, the following vulnerability has been resolved:
mm: don't s... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-99096 In the Linux kernel, the following vulnerability has been resolved:
io_uring/re... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-99097 In the Linux kernel, the following vulnerability has been resolved:
tee: shm: r... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-99098 In the Linux kernel, the following vulnerability has been resolved:
dm-integrit... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-98943 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.