October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,081
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,903
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103858 MISP contains an incomplete authorization check in the discussion posting functi... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101901 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated B... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103656 Rejected reason: this is rejected |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows atta... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-94684 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-81433 A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fin... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.