October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,370
Critical
1,327
High
5,803
Medium
6,212
Low
648
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63399 Coop is an open source review and moderation tool from ROOST. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63344 Refitter is a tool for generating a C# REST API client using the Refit library. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63345 Refitter is a tool for generating a C# REST API client using the Refit library. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-111477 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63201 Netopeer2 is a server for implementing network configuration management based on... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62347 Element Call is a native Matrix video conferencing application. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55613 uhttpd is a small HTTP server. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-55614 uhttpd is a small HTTP server. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62968 Dream Displays provides in-game screens for streaming videos in Minecraft. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62979 jack lets users share media libraries through their Radarr/Sonarr stack, peer-to... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62965 SABnzbd is an open source automated Usenet download tool. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119341 Tesseract is an open source OCR engine. |
none | 0.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117645 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-117666 Improper Validation of Certificate with Host Mismatch vulnerability in deadtrick... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119338 Tesseract is an open source OCR engine. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-95673 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62302 MyTube is a self-hosted downloader and player for several video websites. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62333 OpenVM is a performant and modular zkVM framework built for customization and ex... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62334 OpenVM is a performant and modular zkVM framework built for customization and ex... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62335 OpenVM is a performant and modular zkVM framework built for customization and ex... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62337 SNARK Verifier is a generic (S)NARK verifier. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61850 Kargo manages and automates the promotion of software artifacts. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62284 OSAC operator is a Kubernetes operator. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62301 MyTube is a self-hosted downloader and player for several video websites. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61618 SNARK Verifier is a generic (S)NARK verifier. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115829 In Secret Server versions earlier than 12.3.1, a user could bypass the initial l... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115830 In Secret Server versions earlier than 12.3.1, a user under certain conditions c... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115828 In Secret Server versions earlier than 12.3.1, Secret Server did not always vali... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-73322 Incorrect Authorization vulnerability in the single-stage query engine of Apache... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62298 mouse07410/asn1c is an ASN.1 compiler. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-66025 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-66026 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62162 Hydra is a layer-two scalability solution for Cardano. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61840 Quest Bot is an opensource Discord Bot. |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61845 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61846 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61848 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 sp... |
not reported | — | — | — | 2026-10-30 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.