October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,116
Critical
1,298
High
5,694
Medium
6,075
Low
636
Severity not reported
3,413
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111590 A wide range of Harbor versions allow SSRF via its webhook delivery component wh... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112880 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Respons... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113436 Inefficient Algorithmic Complexity vulnerability in the header integer parser of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113440 Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111101 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111103 Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtru... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110474 This vulnerability exists in the CreditNirvana Agentic AI Call Centre applicatio... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110475 This vulnerability exists in the CreditNirvana Collections Platform due to impro... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110499 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-109584 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110314 Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket c... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108525 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108529 Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107157 Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-96432 A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_S... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2012-20006 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-4316 Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103377 A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116372 MISP mispguard is a security filtering proxy that inspects and blocks MISP feed... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115425 Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall ves... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-96581 Authorization Bypass Through User-Controlled Key vulnerability in ash-project as... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103299 The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secr... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115627 Incorrect Authorization vulnerability in ash-project ash_postgres allows a user... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115635 Incorrect Authorization vulnerability in ash-project ash_postgres allows a user... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114214 Incorrect Authorization vulnerability in ash-project ash allows a client to read... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115822 Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115823 Starman versions before 0.4019 for Perl send response bodies for HEAD requests,... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115824 Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded bu... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115825 HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to cra... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115817 Starman versions before 0.4019 for Perl allow a stalled request body to hold a w... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116184 OpenRemote before 1.31.0 contains an authorization bypass vulnerability that all... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116186 OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116164 Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject rese... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116165 Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing a... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116161 Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an informat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116162 Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire log... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-89284 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
| CVE-2026-111326 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
| CVE-2026-109111 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.