October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,034
Critical
3,238
High
7,713
Medium
7,372
Low
727
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (709), ibm (323), oracle (187), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93820 In the Linux kernel, the following vulnerability has been resolved:
PCI: rockch... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93821 In the Linux kernel, the following vulnerability has been resolved:
PCI: altera... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93803 In the Linux kernel, the following vulnerability has been resolved:
wifi: libip... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93805 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93807 In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93808 In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-a... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93811 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Fix... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93812 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93795 In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93797 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93800 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93802 In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93785 In the Linux kernel, the following vulnerability has been resolved:
cifs: valid... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93788 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93789 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93286 In the Linux kernel, the following vulnerability has been resolved:
net: applet... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93781 In the Linux kernel, the following vulnerability has been resolved:
scsi: core:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93783 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93784 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call
through a f... |
not reported | — | — | — | 2026-09-30 | 2026-10-03 |
| CVE-2026-104886 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104887 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Ne... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18397 This vulnerability enables unauthenticated remote code execution (RCE) on a vict... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Co... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO F... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 al... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104480 Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resu... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-21140 Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 a... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86325 A stack-based buffer overflow vulnerability exists in protocol gateways' account... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86326 An improper verification of cryptographic signature vulnerability exists in prot... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.