October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86344 A flaw was found in 389-ds-base. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-51888 langflow-ai langflow v1.8.4 is affected by: Directory Traversal. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51873 Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_proje... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51874 In Devika v1.0, the Patcher Agent save_code_to_project function contains a path... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-104051 PictShare before 3.7.1 contains an information disclosure vulnerability that all... |
high | 8.2 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 migh... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-56661 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-53964 Document Merge Service is a document template merge service providing an API to... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-54049 Sakai is a Collaboration and Learning Environment (CLE). |
high | 8.7 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write dat... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102667 Joyland AI app allows an attacker with shared network access to inject JavaScrip... |
high | 8.3 | — | — | 2026-10-01 | 2026-10-07 |
| CVE-2026-55230 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55231 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55232 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-104057 Podgrab contains an unauthenticated denial-of-service vulnerability caused by un... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability i... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-15911 Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a re... |
high | 7.4 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-97662 An argument injection issue in the diff scan operation in AWS security-agent-mcp... |
high | 8.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-68495 The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamRead... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-68496 The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamRea... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-12542 A flaw was found in Foreman. |
high | 7.8 | — | Redhat / satellite | 2026-10-01 | 2026-10-16 |
| CVE-2026-104018 An improper privilege management vulnerability (CWE-269) exists in the command s... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2023-54404 Zod schema-validation library contains an uncontrolled resource consumption vuln... |
high | — | — | — | 2026-10-01 | 2026-10-28 |
| CVE-2026-96658 A flaw was found in Foreman. |
high | 8.8 | — | Redhat / satellite | 2026-10-01 | 2026-10-18 |
| CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an au... |
high | 8.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Serv... |
high | 7.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63718 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Fo... |
high | 8.1 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-59685 Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while process... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63045 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Softwar... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63292 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apa... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache H... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-56153 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-02 |
| CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with cr... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-21 |
| CVE-2026-48005 Missing authentication checks in mod_auth_digest in Apache Software Foundation A... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-13043 A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMA... |
high | 8.8 | — | Watchguard / endpoint security | 2026-10-01 | 2026-10-16 |
| CVE-2026-14316 The revoked-key error path builds a human-readable failure reason using sprintf(... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-12540 A flaw was found in Foreman. |
high | 8.2 | — | Redhat / satellite | 2026-10-01 | 2026-10-08 |
| CVE-2026-12541 A flaw was found in Foreman. |
high | 8.2 | — | Redhat / satellite | 2026-10-01 | 2026-10-08 |
| CVE-2026-12544 A flaw was found in Foreman. |
high | 7.7 | — | Redhat / satellite | 2026-10-01 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.