October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,087
Critical
3,247
High
7,734
Medium
7,399
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated B... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103656 Rejected reason: this is rejected |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows atta... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-94684 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-81433 A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fin... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.