October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,463
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107702 QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHot... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107695 FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer t... |
medium | 6.5 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107379 savg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107380 savg-sanitizer is a PHP SVG/XML sanitizer. |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107361 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode:... |
medium | 4.2 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107336 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" loc... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107332 Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107334 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an au... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107335 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-co... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-50055 A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-61801 The `github.com/moby/sys/user` package provides Go utilities for parsing and loo... |
medium | 5.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-107301 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-10631 An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suit... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107294 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107297 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107298 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107299 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107290 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107291 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 4.3 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107292 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.4 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-14 |
| CVE-2026-107293 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 5.3 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-19585 HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in t... |
medium | 5.9 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107677 FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demu... |
medium | 4.7 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_... |
medium | 4.7 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107289 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.8 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate valida... |
medium | 4.8 | — | Ffmpeg / ffmpeg | 2026-10-08 | 2026-10-14 |
| CVE-2026-107287 Pydantic AI is a Python agent framework for building applications and workflows... |
medium | 6.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-14 |
| CVE-2026-106177 A kernel buffer overflow vulnerability in HP Sure Click versions prior to 4.4.33... |
medium | 6.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-95125 libming through 0.4.8 contains a heap buffer overflow in r_readc() in src/blocks... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-14509 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-12859 Missing Authorization vulnerability in Caz Informatics Services Trade Inc. |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-13257 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 6.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-13258 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.4 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14273 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 6.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107623 A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keyc... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107634 Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107635 Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk()... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-16 |
| CVE-2026-107636 pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation v... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.