October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,456
Critical
1,335
High
5,835
Medium
6,248
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105742 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.3 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105698 Langflow is a tool for building and deploying AI-powered agents and workflows. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105438 A flaw has been found in O2OA up to 10.0.1-ce. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105444 A security flaw has been discovered in dotnet eShop .NET 8. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105447 A flaw was found in Quay. |
medium | 5.5 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-101893 Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without... |
medium | 4.4 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-95264 Feehi CMS 2.1.1 is vulnerable to Directory Traversal. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78862 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
medium | 6.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71297 A flaw was found in the maestro gRPC broker. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71298 A flaw was found in maestro. |
medium | 6.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71299 A flaw was found in Maestro. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105695 Penpot is an open-source design and prototyping platform. |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105696 Penpot is an open-source design and prototyping platform. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105692 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105693 Penpot is an open-source design and prototyping platform. |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105694 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105688 Penpot is an open-source design and prototyping platform. |
medium | 6.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105690 Penpot is an open-source design and prototyping platform. |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105684 Penpot is an open-source design and prototyping platform. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105687 Penpot is an open-source design and prototyping platform. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105681 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105680 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105676 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105678 Ghost is a Node.js content management system. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105647 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105648 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105388 A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105389 A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-103337 Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shi... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104029 A flaw was found in SSSD. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-05 | 2026-10-31 |
| CVE-2026-104030 A flaw was found in sssd. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-05 | 2026-10-28 |
| CVE-2026-97304 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploi... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95165 Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organ... |
medium | 6.1 | — | — | 2026-10-05 | 2026-10-12 |
| CVE-2026-95166 In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows... |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-12 |
| CVE-2026-97275 Improper Validation of Specified Quantity in Input vulnerability in VillaTheme B... |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-58834 In setPermissionGrantState of DevicePolicyManagerService.java, there is a possib... |
medium | 5.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-55265 In multiple functions of PduParser.java, there is a possible out of bounds read... |
medium | 6.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-28667 In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due t... |
medium | 5.5 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-105644 Ghost is a Node.js content management system. |
medium | 6.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105645 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.