October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-64946 A chained CSRF and unrestricted SVG file upload vulnerability in the File Manage... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103858 MISP contains an incomplete authorization check in the discussion posting functi... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101901 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated B... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103656 Rejected reason: this is rejected |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows atta... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-94684 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-81433 A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fin... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.