October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,337
Critical
3,273
High
7,854
Medium
7,530
Low
728
Severity not reported
4,952
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94636 Improper handling of highly compressed data (data amplification), Function call... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91135 Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85086 Improper certificate validation, Initialization of a resource with an insecure d... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85087 Improper certificate validation, Return of wrong status code vulnerability in Ap... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85088 Improper Validation of Certificate with Host Mismatch in the C++ and D libraries... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86535 Loop with unreachable exit condition ('infinite loop'), Improperly controlled mo... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86536 Improperly controlled modification of object prototype attributes ('prototype po... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-87117 NULL pointer dereference vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85476 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-82458 Memory allocation with excessive size value, Allocation of resources without lim... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-82459 Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apa... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83663 Uncontrolled Recursion vulnerability in Apache Thrift go bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83745 Memory allocation with excessive size value, Improper handling of length paramet... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59669 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59670 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59671 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59663 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59664 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-17508 In Bouncy Castle for Java before 1.86, several password-based key derivation ent... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % ope... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104853 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104854 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59665 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59672 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59673 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59666 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59667 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59668 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104733 User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attack... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104721 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-cla... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-27872 - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG all... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-94635 Allocation of resources without limits or throttling, Improper handling of lengt... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94650 Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96294 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85483 Use of uninitialized resource, Return of wrong status code vulnerability in Apac... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85493 Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66081 Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66837 Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apa... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66858 The protocol skip routine in several Apache Thrift bindings did not apply the bi... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.