October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87110 An unauthenticated user with network access to the Ops Manager web port can repe... |
medium | 5.3 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
| CVE-2026-87108 An authenticated Ops Manager user with a read-only project role can retrieve a d... |
medium | 4.3 | — | Mongodb / ops manager | 2026-10-09 | 2026-10-15 |
| CVE-2026-107888 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdChec... |
medium | 5.5 | — | Openprinting / cups | 2026-10-09 | 2026-10-20 |
| CVE-2026-107889 A flaw was found in the login theme rendering component of Keycloak. |
medium | 5.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-107890 OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by re... |
medium | 5.5 | — | Openprinting / cups | 2026-10-09 | 2026-10-20 |
| CVE-2026-107886 OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class manageme... |
medium | 6.5 | — | Openprinting / cups | 2026-10-09 | 2026-10-20 |
| CVE-2026-107885 OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in... |
medium | 5.5 | — | Openprinting / cups | 2026-10-09 | 2026-10-20 |
| CVE-2026-94448 When a JavaScript template literal contains consecutive expressions, the context... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-97030 A trusted template author may have previously written a valid template wherein t... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-83947 Missing authorization in Azure Event Grid allows an authorized attacker to perfo... |
medium | 6.5 | — | Microsoft / azure event grid | 2026-10-08 | 2026-10-15 |
| CVE-2026-107729 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107730 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107731 SumatraPDF is a multi-format reader for Windows. |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107651 A flaw was found in Eye of GNOME (eog). |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-87980 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker t... |
medium | 5.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84230 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a den... |
medium | 5.9 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84247 IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-107799 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107800 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107801 Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that a... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107828 Jivejdon through 5.0 contains an authentication bypass vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107829 Jivejdon through 5.0 contains a weak password storage vulnerability that stores... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107830 Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107831 Jivejdon through 5.0 contains a cross-site request forgery vulnerability that al... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107792 Jivejdon from commit d58a36b0 through commit ee67a65e contains a missing authori... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107793 Jivejdon through 5.0 contains an authorization bypass vulnerability in Subscript... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107796 Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107797 Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107798 jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-si... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107721 fast-jwt provides fast JSON Web Token (JWT) implementation. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107714 The Mechanize library is used for automating interaction with websites. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107715 The Mechanize library is used for automating interaction with websites. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107717 Banks generates meaningful LLM prompts using a simple template language. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107718 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS fra... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107719 fast-jwt provides fast JSON Web Token (JWT) implementation. |
medium | 4.2 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2025-71428 Jivejdon through 5.0 contains a sql injection vulnerability in AccountDaoSql.get... |
medium | 4.9 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-104628 Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expr... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105269 Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripti... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105275 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal v... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107399 The Mechanize library is used for automating interaction with websites. |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.