October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78407 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.4 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-78399 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-19494 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19878 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-16830 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.4 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-17189 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 6.1 | — | Ibm / security verify access | 2026-10-08 | 2026-10-13 |
| CVE-2026-11936 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.4 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-11939 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.3 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-12091 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
medium | 5.3 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-107708 MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the... |
medium | 4.9 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107778 MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106435 The MongoDB Python Driver's binary accelerator can read outside a buffer when an... |
medium | 4.7 | — | Mongodb / python driver | 2026-10-08 | 2026-10-15 |
| CVE-2026-107397 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 4.4 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-84244 IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulne... |
medium | 6.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-84274 IBM Guardium Data Protection 12.2.2 is affected by a sensitive information expos... |
medium | 6.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-107705 Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107706 Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107394 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107395 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107396 Indico is an event management system that uses Flask-Multipass, a multi-backend... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107608 Improper link resolution before file access in the asset bundling output handlin... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107389 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-21 |
| CVE-2026-107393 FreeScout is a self-hosted help desk and shared mailbox. |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-106436 The BSON encoder in the MongoDB PHP Driver does not check some return values aft... |
medium | 6.5 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-95209 An issue in gnutls v3.8.13 causes legitimate CA certificates to be rejected, lea... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-84290 IBM Guardium Data Protection 12.0, 12.1, 12.2 is affected by an improper validat... |
medium | 5.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-13 |
| CVE-2026-107387 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107388 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-14 |
| CVE-2026-107324 An integer overflow in BSON value-length handling in the MongoDB Go Driver can c... |
medium | 5.9 | — | Mongodb / go driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-107325 Improper validation of a BSON array length in the MongoDB Go Driver can cause an... |
medium | 5.9 | — | Mongodb / go driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-107382 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106431 An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can... |
medium | 5.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106434 The explicit decryption component of MongoDB libmongocrypt can return an unrecog... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106429 An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106430 The MongoDB C++ Driver discards content after an embedded NUL byte in certain fi... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-95184 Improper certificate validation in gnutls v3.8.13 causes the application to reje... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-95210 Improper certificate validation in gnutls v3.8.13 causes the application to acce... |
medium | 4.8 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-107696 FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect(... |
medium | 6.5 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107697 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer t... |
medium | 4.3 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-15 |
| CVE-2026-107698 FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forger... |
medium | 5.4 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.