October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,087
Critical
3,247
High
7,734
Medium
7,399
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. |
not reported | — | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-96515 This
vulnerability exists in the Netlink ICT HG323RW router due to insufficient... |
not reported | — | — | — | 2026-09-24 | 2026-10-12 |
| CVE-2026-80729 In the Linux kernel, the following vulnerability has been resolved:
mm/huge_mem... |
not reported | — | — | — | 2026-09-03 | 2026-10-11 |
| CVE-2026-82049 In CPython 3.13 and earlier, the tarfile module's data and tar extraction filter... |
not reported | — | — | — | 2026-09-14 | 2026-10-11 |
| CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Serv... |
not reported | — | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107231 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107282 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-102916 A reachable assertion in the illumos bhyve instruction emulator allows a guest t... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107802 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-4264 Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, speci... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108125 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infe... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Ana... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java objec... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a pack... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireG... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) a... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd)... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105673 An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107725 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107734 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107735 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107736 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107716 Banks generates meaningful LLM prompts using a simple template language. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107386 amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-93860 In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-102368 Affected Tapo device firmware stores device-specific cryptographic material in p... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-39725 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105331 Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with a... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-15688 Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi... |
not reported | — | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-106104 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105844 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105828 Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an in... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93699 Argument injection in WP Toolkit for cPanel allows local users to execute arbitr... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.