October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,348
Critical
1,326
High
5,799
Medium
6,207
Low
649
Severity not reported
3,367
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118254 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118255 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118249 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118250 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118243 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118244 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-118245 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118246 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118247 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118248 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in ch... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116794 russh is a Rust SSH client and server library that includes an SSH agent protoco... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116796 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116797 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117500 HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backt... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117501 HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounde... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118242 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116266 MIME::Head versions from 5.518 before 5.521 for Perl decode a partly encoded mul... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116267 MIME::Parser versions before 5.521 for Perl allow memory exhaustion via indented... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116268 MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaustion via un... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116269 MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 filename w... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116270 MIME::Words versions before 5.521 for Perl allow memory exhaustion via repeated... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116271 MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created outpu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116272 MIME::Field::ParamVal versions before 5.521 for Perl do not flag a duplicate bou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116273 MIME::Parser versions before 5.521 for Perl set no limit on the number of messag... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116285 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic r... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116131 HTTP::Body versions before 1.23_01 for Perl allow memory and temporary file exha... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116132 HTTP::Body versions before 1.23_01 for Perl leave the temporary file of an incom... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116133 HTTP::Body versions before 1.23_01 for Perl allow CPU exhaustion via quadratic r... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116134 HTTP::Body versions before 1.23_01 for Perl allow memory exhaustion via an unbou... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116264 MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid Content-T... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116265 MIME::Field::ParamVal versions before 5.521 for Perl do not flag an ambiguous mu... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93524 A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWaylan... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83525 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler
in Apache Kafka fr... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117617 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117618 In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for cre... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117619 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117620 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117621 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.