October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,462
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,364
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76276 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privilege... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76277 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 4.1 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76264 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76265 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Spl... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76267 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that hol... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76269 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76270 In Splunk Enterprise versions below 10.4.3, a user that holds a role with the li... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-1403 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107229 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 4.0 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107176 A flaw was found in the cluster-samples-operator. |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-30 |
| CVE-2026-107353 traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107224 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107225 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107313 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the prev... |
medium | 4.2 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107218 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.3 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107220 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107221 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107222 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 6.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107211 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107213 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
medium | 5.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-106066 A heap-based buffer overflow was found in GIMP’s raw data export plug-in. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-106067 A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76488 A vulnerability in the export policies functionality of Cisco Application Policy... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76437 A vulnerability in the web-based user interface of Cisco License On-Prem, former... |
medium | 4.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76452 A vulnerability in the web-based management interface of Cisco License On-Prem,... |
medium | 4.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20321 A vulnerability in the web-based management API for Cisco Application Policy Inf... |
medium | 6.5 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20032 A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an... |
medium | 4.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20038 A vulnerability in the endpoint group (EPG) contract functionality of Cisco Nexu... |
medium | 5.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-20173 A vulnerability in Cisco NX-OS Software could allow an unauthenticated, remote a... |
medium | 5.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-106065 A heap-based buffer overflow was found in GIMP’s PCX export plug-in. |
medium | 6.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-101886 Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path tra... |
medium | 4.0 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in... |
medium | 5.3 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-107273 Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerabili... |
medium | 4.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107271 Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows un... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107272 Gophish through 0.12.1 contains stored and reflected cross-site scripting vulner... |
medium | 4.7 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106577 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107166 A weakness has been identified in Open5GS up to 2.7.7. |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.