October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118605 Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118606 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Executi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118510 A type-handling flaw in the relationship query building of this MongoDB integrat... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106079 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103410 An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Netw... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Ses... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103407 An Improper Limitation of a Pathname to a Restricted Directory vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103408 A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Ses... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103401 An Improper Link Resolution Before File Access ('Link Following') vulnerability... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Junip... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103403 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-100105 A user with permission to edit contact points but not their protected fields can... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93521 A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server bef... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO pa... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-56828 Shopper is a Headless e-commerce Admin Panel. |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59979 YosemiteCrew provides organization-based service and task management. |
high | 8.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-sid... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116778 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', be... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buff... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Or... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocN... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59185 identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kube... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-52729 Xibo is an open source digital signage platform with a web content management sy... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59164 NORA is a self-hosted artifact registry and pull-through cache. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59177 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59179 OpenHop is a tool for creating interactive data-flow diagrams. |
high | 8.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116389 Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116390 Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything —... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115590 Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allow... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115603 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Co... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.