October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache... |
medium | 6.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Serv... |
medium | 5.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Soft... |
medium | 5.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-42528 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an... |
medium | 4.3 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-42356 Deployment of wrong handler vulnerability in Apache HTTP Server allows the targe... |
low | 3.7 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.