October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101957 An Improper Initialization vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101965 An Use of Externally-Controlled Format String vulnerability in the gRPC daemon o... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101966 A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd o... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101943 An Improper Input Validation vulnerability in the routing protocol daemon (rpd)... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101944 An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101945 An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101948 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101939 A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101940 A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101941 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101942 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101927 A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos O... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100236 A flaw was found in the DPDK GSO library. |
high | 8.6 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2016-15060 A vulnerability was found in PCMan FTP Server up to 2.0.7. |
high | 8.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-89077 Incorrect implementation of authentication algorithm vulnerability in Progress M... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-91156 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-91157 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-91159 Discourse is an open-source discussion platform. |
high | 7.7 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-91882 Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Inser... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfe... |
high | 7.5 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certif... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Trans... |
high | 7.3 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-87093 Incorrect Permission Assignment for Critical Resource vulnerability in Progress... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-16 |
| CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progre... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-53615 util-linux is a random collection of Linux utilities. |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53614 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103929 mise manages dev tools like node, python, cmake, and terraform. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102695 OmniFaces is a utility library for Faces. |
high | 8.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_modul... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-91184 Description
NGINX Gateway Fabric has a vulnerability when it renders the spec.b... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94197 An authentication and authorization bypass vulnerability exists in F5 NGINX Kube... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-73800 Gitea resolves local reusable workflow files from a fork's head commit when a tr... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job contai... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73804 Gitea allows a token with write:user scope to register an attacker-controlled SS... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrol... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.