October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,384
Critical
3,278
High
7,871
Medium
7,568
Low
735
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94654 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94655 Allocation of resources without limits or throttling, Inefficient Algorithmic Co... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94656 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94657 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94658 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96287 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled c... |
not reported | — | — | — | 2026-09-23 | 2026-10-02 |
| CVE-2026-94636 Improper handling of highly compressed data (data amplification), Function call... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91135 Heap-based buffer overflow vulnerability in Apache Thrift C++ THeaderTransport. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85086 Improper certificate validation, Initialization of a resource with an insecure d... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85087 Improper certificate validation, Return of wrong status code vulnerability in Ap... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85088 Improper Validation of Certificate with Host Mismatch in the C++ and D libraries... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86535 Loop with unreachable exit condition ('infinite loop'), Improperly controlled mo... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86536 Improperly controlled modification of object prototype attributes ('prototype po... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-87117 NULL pointer dereference vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85476 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-82458 Memory allocation with excessive size value, Allocation of resources without lim... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-82459 Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apa... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83663 Uncontrolled Recursion vulnerability in Apache Thrift go bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83745 Memory allocation with excessive size value, Improper handling of length paramet... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59669 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59670 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59671 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59663 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59664 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-17508 In Bouncy Castle for Java before 1.86, several password-based key derivation ent... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % ope... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104853 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104854 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59665 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59672 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59673 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59666 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59667 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59668 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104733 User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attack... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104721 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-cla... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-27872 - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG all... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-94635 Allocation of resources without limits or throttling, Improper handling of lengt... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.