October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105753 vLLM is an inference and serving engine for large language models. |
medium | 6.5 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105743 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.8 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-105746 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.3 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105747 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 4.3 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105748 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 4.3 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105749 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 6.5 | — | Docling / docling | 2026-10-05 | 2026-10-08 |
| CVE-2026-103546 In MongoDB Controllers for Kubernetes, insufficient validation of Ops Manager ba... |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105742 Docling simplifies document processing by parsing diverse formats and providing... |
medium | 5.3 | — | Docling / docling | 2026-10-05 | 2026-10-07 |
| CVE-2026-105698 Langflow is a tool for building and deploying AI-powered agents and workflows. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105438 A flaw has been found in O2OA up to 10.0.1-ce. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105444 A security flaw has been discovered in dotnet eShop .NET 8. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105447 A flaw was found in Quay. |
medium | 5.5 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-101893 Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without... |
medium | 4.4 | — | — | 2026-10-05 | 2026-10-11 |
| CVE-2026-95264 Feehi CMS 2.1.1 is vulnerable to Directory Traversal. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78862 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
medium | 6.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71297 A flaw was found in the maestro gRPC broker. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71298 A flaw was found in maestro. |
medium | 6.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-71299 A flaw was found in Maestro. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105695 Penpot is an open-source design and prototyping platform. |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105696 Penpot is an open-source design and prototyping platform. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105692 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105693 Penpot is an open-source design and prototyping platform. |
medium | 5.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105694 Penpot is an open-source design and prototyping platform. |
medium | 5.4 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105688 Penpot is an open-source design and prototyping platform. |
medium | 6.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105690 Penpot is an open-source design and prototyping platform. |
medium | 5.9 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105684 Penpot is an open-source design and prototyping platform. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-105687 Penpot is an open-source design and prototyping platform. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105681 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105680 Ghost is a Node.js content management system. |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105676 Ghost is a Node.js content management system. |
medium | 4.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105678 Ghost is a Node.js content management system. |
medium | 4.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105647 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105648 Ghost is a Node.js content management system. |
medium | 4.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105388 A weakness has been identified in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105389 A security vulnerability has been detected in feelec-yishu feelcrm-os 1.0.0. |
medium | 6.3 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-103337 Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shi... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104029 A flaw was found in SSSD. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-05 | 2026-10-31 |
| CVE-2026-104030 A flaw was found in sssd. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-05 | 2026-10-28 |
| CVE-2026-97304 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploi... |
medium | 6.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95165 Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organ... |
medium | 6.1 | — | — | 2026-10-05 | 2026-10-12 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.