October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,140
Critical
1,303
High
5,710
Medium
6,092
Low
636
Severity not reported
3,399
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112425 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112428 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112429 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112430 An authentication issue was addressed with improved validation of user attribute... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112414 A stack overflow was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112416 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112417 An integer overflow was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112421 A race condition was addressed with improved handling of symbolic links. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112423 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112410 A double free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112413 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2025-13833 A vulnerability exists in SecureConnector for Windows when the “Additional Appli... |
not reported | — | — | — | 2026-10-26 | 2026-10-28 |
| CVE-2026-65632 The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65626 The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bl... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65627 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65628 jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65629 Use of Password Hash With Insufficient Computational Effort in the jose library... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65630 Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65631 Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remo... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57196 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-65625 The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57184 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-57187 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57193 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-115533 The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104597 libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initializat... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104598 libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116638 The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attac... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104592 libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPL... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104593 osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_nam... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-104594 libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-71455 Cleartext storage of sensitive information in memory vulnerability in Johnson Co... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-71456 Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech En... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116596 Pyrus Sync for Windows contains a local privilege escalation vulnerability cause... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115905 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106676 qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImp... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-106677 Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-85297 Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Clou... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65202 Rejected reason: The reported issue was assessed as intended functionality. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-65203 Rejected reason: The reported issue could not be reproduced. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.