October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,081
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,903
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105786 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105050 PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS comman... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104966 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105686 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104855 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-79113 OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104055 The postgresql-operator charm runs a Prometheus postgres_exporter to collect dat... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-105090 Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0482 In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59357 Insufficient verification of data authenticity (CWE-345) in the external OIDC lo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59358 Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry U... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-80327 An open redirect vulnerability exists in the PingGateway Fragment Filter feature... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59782 The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerabili... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59783 The Zabbix Server/Proxy has a vulnerability where binary items can crash the Ser... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59785 Host search in Frontend allows filtering by fields that are not displayed, inclu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59787 The Perl SNMP trap receiver script shipped with Zabbix does not properly neutral... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59788 The email media type OAuth form passes the Authorization endpoint value to windo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functiona... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause th... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerab... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-4889 SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103831 CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104976 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-84900 Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104873 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-75937 A specially crafted HTTP POST request to the web administration interface allows... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.