October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,300
Critical
1,323
High
5,783
Medium
6,188
Low
643
Severity not reported
3,363
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111467 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111479 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111563 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-112155 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2025-12534 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-97045 In childTextNodesAreLiteral, walking up the tree previously stopped at the neare... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-78661 When coalescing adjacent text nodes in addText and fosterParent, appending to an... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57190 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57191 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57192 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57199 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57203 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-116775 pageant provides a PageantStream type that implements AsyncRead and AsyncWrite t... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-39928 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116693 dd-trace is the Datadog APM client for Node.js. |
not reported | — | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116694 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116695 Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specifi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103995 Response body and chunk parsing would handle non-hex or negative integers incorr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118174 When a message containing an OpenPGP key attachment was displayed, Thunderbird a... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunder... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118177 When looking for calendars in a directory on a server, during account setup or w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118178 A remote RSS feed could use the itunes:new-feed-url or newLocation element to pe... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118179 Clicking a news: or snews: link that referenced a message-ID made Thunderbird co... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118180 When logging in to a Matrix account, Thunderbird used the homeserver address pro... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118170 The strapi/review-workflows package is vulnerable to a broken access control vul... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118171 The strapi/content-manager package is missing content-scope authorization in the... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118172 The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118173 MISP Guard, a proxy that enforces security policies on MISP feed data, contained... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116683 CTFer.io's CTFd Terraform Provider manages CTFd resources as code. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57188 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118131 GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discre... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118132 NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulner... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116677 OpenWISP Controller is a network and WiFi controller for provisioning, configura... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-111054 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-102814 An
authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE30... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102815 An
operating-system command injection vulnerability exists in the tmpServer
serv... |
not reported | — | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-102816 An authorization vulnerability exists in the country or region configuration int... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102812 A hard-coded
cryptographic key vulnerability exists in the user-configuration ba... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.