October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,979
Critical
1,280
High
5,617
Medium
5,999
Low
633
Severity not reported
3,450
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1302), google (733), ibm (140), adobe (128), oracle (120), broadcom (61), langflow (56), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-119195 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119196 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119197 pyasn1 is a generic ASN.1 library for Python. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119187 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119188 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-9536 A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader Find... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-9535 A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 func... |
high | 8.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-8822 A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functi... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-8824 A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInfo... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119168 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119249 A malicious actor with access to the network could exploit a Binding to an Unres... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119250 A malicious actor with local access and low privileges could exploit an External... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-41216 An invalid pointer dereference vulnerability exists in the vtkPNGReader::Execute... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-42057 An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGR... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118782 Forge (also called node-forge) is a native implementation of Transport Layer Sec... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118772 joi is a schema description language and data validator for JavaScript. |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107347 HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during... |
high | 8.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-11587 SQL injection allowing an authenticated user with access to ACL management to re... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118763 sigstore-js provides JavaScript libraries for interacting with Sigstore services... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119115 Incorrect authorization in the issuer resolution logic in AWS Private CA Connect... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118758 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118759 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118761 Kubeflow Pipelines enables users to build and deploy portable, scalable machine... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115805 Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107047 Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized at... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead v... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96203 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96187 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96192 Use after free in Microsoft Edge for iOS allows an unauthorized attacker to exec... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows a... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96198 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96199 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90869 A remote attacker who knows a valid account's enrolled SSH public key can termin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-90867 Improper access control in the Web Admin console of Progress Software WS_FTP Ser... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-88077 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unau... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85890 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85897 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85899 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-84294 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Sof... |
high | 7.7 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.