October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,457
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,359
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95112 When processing issue and comment bodies, Gitea scanned the entire preceding tex... |
medium | 6.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79814 An arbitrary file write vulnerability in the ClearPass Policy Manager OnGuard ag... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79815 A command injection vulnerability in the OnGuard agent of ClearPass Policy Manag... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79816 A vulnerability in a client interface of HPE Networking ClearPass Policy Manager... |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79817 A sensitive information disclosure vulnerability exists in the client software o... |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79818 A vulnerability in an API interface of ClearPass Policy Manager could allow an u... |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79812 A denial of service vulnerability exists in the OnGuard agent of HPE Networking... |
medium | 6.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79813 A local privilege escalation vulnerability exists in the ClearPass client softwa... |
medium | 6.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76749 A sensitive information disclosure vulnerability exists in AOS-S. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-76061 A flaw was found in CRI-O's `bind_mount_prefix` handling. |
medium | 5.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-76741 Buffer overflow vulnerabilities exist in the affected interface of AOS-S. |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106450 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106452 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106453 yawkat LZ4 Java provides LZ4 compression for Java. |
medium | 5.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106454 Twisted is an event-based framework for internet applications, supporting Python... |
medium | 4.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106444 Handlebars provides the power necessary to let users build semantic templates. |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106063 A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. |
medium | 6.3 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105242 Improper Handling of Exceptional Conditions vulnerability in the aspnet-request... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105243 Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105244 Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppende... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105111 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105239 Improper Neutralization of Null Byte or NUL Character vulnerability in the Event... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105240 Improper Neutralization of Null Byte or NUL Character vulnerability in the Outpu... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105241 Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-103008 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103667 Gitea's container registry served blob downloads with a `Content-Type` taken fro... |
medium | 5.4 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-104047 A flaw was found in SSSD. |
medium | 5.3 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-31 |
| CVE-2026-102410 Missing Authorization (CWE-862) in Kibana can lead to information disclosure via... |
medium | 4.3 | — | Elastic / kibana | 2026-10-06 | 2026-10-09 |
| CVE-2026-102411 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-102412 Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information di... |
medium | 6.5 | — | Elastic / kibana | 2026-10-06 | 2026-10-09 |
| CVE-2026-102413 Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service v... |
medium | 6.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-102168 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthent... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102169 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthent... |
medium | 6.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102404 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102407 Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data... |
medium | 5.4 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102408 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead t... |
medium | 4.3 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102409 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated use... |
medium | 6.5 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-13 |
| CVE-2026-102156 Improper neutralization of Lightweight Directory Access Protocol (LDAP) authenti... |
medium | 6.8 | — | — | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.