October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,327
High
5,804
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107269 Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServe... |
low | 3.7 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107170 A flaw was found in m17n-lib. |
low | 2.9 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104678 The CP Media Player WordPress plugin before 1.3.4 does not perform a capability... |
low | 2.7 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-106587 In sshd in OpenSSH before 10.6, the value "none" for a configuration option is s... |
low | 3.3 | — | Openbsd / openssh | 2026-10-06 | 2026-10-09 |
| CVE-2026-106588 In sshd in OpenSSH through 10.6, use of the macOS 27 (or later) SDK has the side... |
low | 3.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106589 In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO O... |
low | 2.9 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106582 In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used eve... |
low | 3.7 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106584 In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expirati... |
low | 3.3 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106449 yawkat LZ4 Java provides LZ4 compression for Java. |
low | 3.7 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102164 On affected Arista access points configured with VXLAN tunnelling and L2-proxy (... |
low | 3.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106399 Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a loc... |
low | 3.3 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106339 Use of released resource in Core in Google Chrome prior to 155.0.8059.39 allowed... |
low | 3.1 | — | Google / chrome | 2026-10-06 | 2026-10-07 |
| CVE-2026-106224 Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 all... |
low | 3.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106210 Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed... |
low | 3.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106180 Observable discrepancy in Animation in Google Chrome prior to 155.0.8059.39 allo... |
low | 3.1 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-106101 Quasar Framework is a framework for building high-performance Vue.js user interf... |
low | 3.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105950 A security vulnerability has been detected in getformwork formwork up to 2.3.12. |
low | 3.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105800 i18next-http-backend is a backend layer for i18next that loads translation resou... |
low | 3.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105795 Kiota is an OpenAPI based HTTP Client code generator. |
low | 3.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106026 tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_... |
low | 3.7 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-56596 HCL BigFix Service Management is affected by an Improper Input Validation vulner... |
low | 3.5 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105808 A vulnerability was determined in SourceCodester Simple Student Information Syst... |
low | 3.5 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105611 A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. |
low | 2.7 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-105752 vLLM is an inference and serving engine for large language models. |
low | 3.1 | — | Vllm / vllm | 2026-10-05 | 2026-10-08 |
| CVE-2026-105766 Use of the backend-facing $scheme variable in the trailing-slash directory redir... |
low | 3.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105767 Improper Neutralization of Special Elements used in an OS Command in the integra... |
low | 3.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105683 Ghost is a Node.js content management system. |
low | 3.8 | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105682 Ghost is a Node.js content management system. |
low | 2.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105652 Ghost is a Node.js content management system. |
low | 3.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-58856 In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a p... |
low | 3.3 | — | Google / android | 2026-10-05 | 2026-10-07 |
| CVE-2026-105712 gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an ar... |
low | 3.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105326 An argument injection flaw was found in CUPS. |
low | 2.5 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-77803 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262... |
low | 3.6 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105289 A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. |
low | 3.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105245 A vulnerability has been found in sgl-project sglang up to 0.5.21. |
low | 3.7 | — | — | 2026-10-05 | 2026-10-07 |
| CVE-2026-105237 A vulnerability was detected in linlinjava litemall up to 1.8.0. |
low | 3.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105188 A vulnerability was found in code-projects Human Resource Management System 1.0. |
low | 3.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105179 A weakness has been identified in SourceCodester Drug Recommendation System 1.0. |
low | 2.7 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105173 A flaw has been found in code-projects Human Resource Management 1.0. |
low | 3.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105164 A flaw has been found in NASA cFS up to 7.0.1. |
low | 2.7 | — | — | 2026-10-04 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.