October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,034
Critical
3,238
High
7,713
Medium
7,372
Low
727
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (709), ibm (323), oracle (187), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106513 MISP exposes critical infrastructure settings—specifically the Redis host addres... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106448 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCC... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106547 A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92531 Operating system command injection vulnerability in the SVN integration componen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107175 MISP contains a defect in its event save workflow that prevents the correlation... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required),... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106447 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-104945 TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-103435 Claude Code validated that a target file path resided within the project working... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104944 TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud C... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93026 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modif... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-66666 Insertion of Sensitive Information Into Sent Data vulnerability in Automattic Wo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-34498 Improper input validation vulnerability in Johnson Controls Illustra Standard -... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106439 Hydra is a framework for elegantly configuring complex applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106107 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106109 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106119 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105804 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105805 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105806 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106105 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106106 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-9032 Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboard... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-105764 Immich is a high-performance self-hosted photo and video management solution. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104914 MISP contains an improper access control vulnerability in its attribute search a... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-103446 Authorization bypass through User-Controlled key vulnerability in The Wikimedia... |
not reported | — | — | — | 2026-09-30 | 2026-10-06 |
| CVE-2026-97149 In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-C... |
not reported | — | — | — | 2026-09-24 | 2026-10-06 |
| CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105786 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105050 PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS comman... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104966 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105686 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104855 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.