October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (744), oracle (154), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108359 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-97631 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Writ... |
not reported | — | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-115502 A missing authorization check allows anyone having access to a "link without log... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-67597 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114606 draw.io Desktop is the official Electron build of draw.io. |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114608 Pylint is a static code analyser for Python. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-94482 Next.js is a React framework for building full-stack web applications. |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-51954 An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to exec... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115450 External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and ch... |
not reported | — | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115453 Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishl... |
not reported | — | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115454 An excessive resource allocation issue in the remote workflow editing capabiliti... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115494 A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115496 Overly informative error messages in the catalog functionality of KNIME Business... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114485 Insufficient protection of sensitive information in the user list endpoint in De... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114486 Incorrect authorization in the Devolutions Gateway token generation in Devolutio... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114487 Missing authorization in the PAM AD computer import endpoint in Devolutions Serv... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-16477 CleanShot X for macOS insecurely deserializes untrusted data embedded in a .clea... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-89409 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and ear... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-89410 In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-107079 An issue in Systrome Validation & Certification 1.0 allows an attacker to cause... |
not reported | — | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOth... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-106017 Improper certificate validation in the OpenVPN 3 Core library version 3.4 throug... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoin... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log d... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-86696 Allocation of Resources Without Limits or Throttling vulnerability in esaml in d... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-93471 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_bindin... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110974 The org.json parser in com.vaadin.external.google:android-json recurses once per... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-105270 Allocation of Resources Without Limits or Throttling vulnerability in esaml_bind... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Brows... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96363 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87941 Vulnerability in Drupal Patreon. |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-89052 A hardcoded cryptographic key management vulnerability exists in Archer C6 due t... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76407 As part of Cisco's ongoing commitment to proactive security and product quality,... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality,... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76528 As part of Cisco's ongoing commitment to proactive security and product quality,... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76529 As part of Cisco's ongoing commitment to proactive security and product quality,... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-106053 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.