October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,116
Critical
1,298
High
5,694
Medium
6,075
Low
636
Severity not reported
3,413
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" modu... |
not reported | — | — | — | 2026-10-24 | 2026-10-27 |
| CVE-2026-114629 Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Conten... |
not reported | — | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-110814 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-108537 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-108793 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115897 Serialize JavaScript serializes JavaScript values to a superset of JSON that inc... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115892 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115883 LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistenc... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115885 The LangGraph CLI is the official command-line interface for LangGraph. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57849 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115775 Twisted is an event-based framework for internet applications, supporting Python... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-113877 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-113951 If an attacker can write to the filesystem of a container k8s cluster container,... |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115580 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115585 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115586 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115572 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-91093 A potential security vulnerability has been identified in HP One Agent for certa... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115567 Tokio is a runtime for writing applications with Rust. |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-58497 Uni-CLI gives people and agents one command interface for websites, browsers, de... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-54668 Kitodo.Production is a workflow management tool for mass digitization and is par... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115478 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115477 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-102786 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-57208 Entire CLI hooks into Git workflows to capture AI agent sessions. |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55826 The GTM Server Side plugin by stape.io implements server-side tracking on WordPr... |
not reported | — | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-53918 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-53920 odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115481 baserCMS is a website development framework. |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114357 Missing authentication for a critical function in the Android Debug Bridge daemo... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114355 OS command injection in the root-privileged 'hardware_monitor' helper in DJI Cry... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114356 Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114354 Missing authorization in the native binder service 'android.dji.server' (transac... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-114353 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant'... |
not reported | — | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-99086 In the Linux kernel, the following vulnerability has been resolved:
dm-integrit... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-99087 In the Linux kernel, the following vulnerability has been resolved:
dm-integrit... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-99080 In the Linux kernel, the following vulnerability has been resolved:
fs: Free an... |
not reported | — | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99084 In the Linux kernel, the following vulnerability has been resolved:
readdir: ta... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-99085 In the Linux kernel, the following vulnerability has been resolved:
sched_ext:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-99071 In the Linux kernel, the following vulnerability has been resolved:
ipv4: do no... |
not reported | — | — | — | 2026-10-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.