October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110654 libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Tele... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110658 Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in ms... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110659 ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocati... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109438 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitiali... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100394 Nezha Monitoring is a self-hostable, lightweight, servers and websites monitorin... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-100404 Zulip is an open-source team collaboration tool. |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-96615 Description
NGINX Gateway Fabric has a vulnerability when it is configured with... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97629 Description
When NGINX Plus or NGINX Open Source is configured with ssl_session_... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-95101 Description
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_htt... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-78231 When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parame... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-78433 Gitea's web attachment handler skips its cross-repository ownership check for at... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73814 Gitea's collaboration access-mode endpoint accepts the Owner access mode from an... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73126 Gitea's Actions workflow status badge endpoint does not enforce repository-read... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73130 Gitea does not limit the length of the gitignores field accepted by repository-c... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73135 Gitea uses inconsistent repository visibility predicates, and the condition used... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73273 Gitea's Maven upload handler reads checksum uploads entirely into memory and ret... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-68957 Gitea's API and web issue-search paths do not treat restricted accounts as anony... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-68964 Gitea's user SSH and GPG key-list API endpoints omit the profile visibility chec... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70396 Gitea's organization repository-creation API requires write:organization but omi... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-70400 Gitea's repository migration API accepts a public-only token when the request sp... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70402 Gitea creates server-side Git hook directories and scripts with mode 0777 and re... |
medium | 5.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70406 Gitea's shared comparison helper omits the token repository-access check used wh... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-70407 Gitea's organization-list API does not enforce the read:organization token scope... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-71301 Gitea's repository markup endpoint resolves same-repository pull request referen... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-60018 Gitea's OneDev migration downloader reads the entire remote version response int... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-60021 Gitea's initial GitLab migration version probe uses an HTTP client without a tim... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-62925 Gitea parses Alpine package uploads before enforcing package-size quotas and doe... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-63021 Gitea's Swift package parser limits each manifest to 128 KiB but does not limit... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-63792 Gitea's collaborative-owner authorization path for reading cross-repository reus... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-66849 Gitea's package registry grants authenticated users read access to packages owne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-66853 Gitea's user organization-list API includes Limited-visibility organizations for... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-66874 For pull request events, Gitea reads workflow definitions from the pull request... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-67577 Gitea's activity-feed and contribution-heatmap API handlers do not apply the pro... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-59766 Gitea's starred-repository and tracked-time API endpoints do not re-check curren... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-60010 Gitea's repository-side team-link API allows a repository administrator who is n... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-25946 When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and per... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulne... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulne... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerabi... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.