October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,348
Critical
1,326
High
5,799
Medium
6,207
Low
649
Severity not reported
3,367
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117622 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send excepti... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117623 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text show... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117624 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117625 A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117626 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file pa... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117612 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserializ... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117613 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117614 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117615 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when c... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-117616 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint tha... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115644 Apache Kafka Connect contains an authentication bypass vulnerability affecting t... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116593 Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate... |
not reported | — | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-114349 When a broker decodes a compressed record batch, the per-record decoder reads a... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-112375 An authenticated Kafka principal with no authorization grants (not even ALTER_CO... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111496 Kafka Streams derives its stream-time clock from record timestamps. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111551 Several Kafka deserialization paths read a size or count field from input data a... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbear... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111073 The broker-side PushTelemetry API (KIP-714) validates only the compressed size o... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111108 Apache Kafka's code-generated protocol readers pre-size an array's collection fr... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111115 Apache Kafka's code-generated readers for flexible protocol versions read a tagg... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundle... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103506 An authenticated user in Grafana can read SSO client secrets and modify instance... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-47235 SimulationCraft is a tool to explore combat mechanics in World of Warcraft. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116776 USB Test is a lightweight Windows CLI utility for verifying sector integrity and... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115402 OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cau... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106971 An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpa... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93517 A heap buffer overflow in handling GLX
RenderLarge request where dataBytes excee... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59959 SAIL is a cross-platform library for loading and saving images with support for... |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116078 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105420 Wing FTP Server does not verify user's base folder. |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93515 A use-after-free in present_clear_window_notifies() in the X.org X Server before... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102790 Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations exp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99215 In the Linux kernel, the following vulnerability has been resolved:
power: supp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99216 In the Linux kernel, the following vulnerability has been resolved:
Drivers: hv... |
not reported | — | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-99207 In the Linux kernel, the following vulnerability has been resolved:
scsi: targe... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99208 In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa:... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99209 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: ski... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99210 In the Linux kernel, the following vulnerability has been resolved:
accel/rocke... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99211 In the Linux kernel, the following vulnerability has been resolved:
netlink: re... |
not reported | — | — | — | 2026-10-28 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.