October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55467 OpenPrinting CUPS is an open source printing system for Linux and other Unix-lik... |
low | 2.5 | — | Openprinting / cups | 2026-10-15 | 2026-10-20 |
| CVE-2026-53575 EspoCRM is an open source customer relationship management application. |
low | 2.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-55184 EspoCRM is an open source customer relationship management application. |
low | 3.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79835 A crafted input message can cause a buffer overflow in HPE Nonstop KMS Server. |
low | 2.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110810 A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. |
low | 2.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110861 Better Auth @better-auth/drizzle-adapter and better-auth from 1.6.17 before 1.7.... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-64856 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-82153 Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of... |
low | 2.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110762 bbPress before 2.6.19 contains an information disclosure vulnerability that allo... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103930 cpp-httplib is a C++ header-only HTTP/HTTPS library. |
low | 3.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-93637 An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-77564 Talos Linux is a Linux distribution built for Kubernetes deployments. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-101991 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101946 An Out-of-bounds Read vulnerability in the rpd process of Juniper Networks Junos... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-77572 VeraCrypt provides disk encryption with strong security based on TrueCrypt. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-49206 rapidcsv is a C++ CSV parser library. |
low | 2.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110734 Godot Engine through 4.7.2 has a heap out-of-bounds write in the Radiance HDR (.... |
low | 2.5 | — | — | 2026-10-14 | 2026-10-24 |
| CVE-2026-110735 Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource... |
low | 2.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110736 Godot Engine through 4.7.2 has an out-of-bounds read in the optimized translatio... |
low | 3.6 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110661 CGNS through 4.5.2 contains a stack out-of-bounds read vulnerability in ADFI_rea... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110655 miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerabilit... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110656 miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerabilit... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a p... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110660 vgmstream through r2117 contains a stack out-of-bounds read vulnerability in the... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-60008 Gitea's Jupyter notebook renderer inserts the notebook's language_info.name meta... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110624 Papermerge Core through 3.5.3 contains a missing authorization vulnerability tha... |
low | 3.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110606 LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-ba... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110604 Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in... |
low | 3.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110592 BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render... |
low | 3.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110262 OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2024-58392 PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS... |
low | 3.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-88842 A flaw was found in BusyBox dpkg. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-73792 A security vulnerability in HPE NonStop Java JToolkit can allow command Injectio... |
low | 3.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73791 A security vulnerability in HPE NonStop Hpjmeter can cause stack and heap buffer... |
low | 2.0 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108066 The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capabi... |
low | 2.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110458 A malicious actor with access to the network and under certain conditions could... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110457 A malicious actor with access to the network and under certain conditions could... |
low | 3.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-77205 Libreswan in FIPS mode has a vulnerability where badly formed received certifica... |
low | 3.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110141 Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed... |
low | 3.1 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-108388 Indico is a feature-rich event management system. |
low | 3.5 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.