October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,081
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,903
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authenti... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written throug... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authenticati... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103511 Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to it... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103512 Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when valid... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-86671 In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93316 If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93317 An unauthenticated attacker controlling a registry or OCI-layout blob source cou... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93318 A malicious image can advertise DiffIDs from another image while containing diff... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93319 A malicious external BuildKit frontend can send requests using the internal API... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93322 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93323 The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103433 Docker Buildx Bake does not request the expected fs.read approval for certain fi... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97309 Missing Authorization vulnerability in Webful Creations RepairBuddy computer-rep... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103335 Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajrac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97070 Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Coz... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97305 Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI C... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104399 Insertion of Sensitive Information Into Sent Data vulnerability in StylemixTheme... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the l... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63268 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it p... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63277 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94201 Ash stores :atom-typed attributes as strings and compares them as strings. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-85153 This vulnerability exists in the Schmooze app due to the use of hardcoded creden... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94206 Use of Password Hash With Insufficient Computational Effort vulnerability in dan... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-95105 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integr... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75818 GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75819 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load()... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through tw... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 94... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API ac... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.