October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (744), oracle (154), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103090 Missing Authentication for Critical Function (CWE-306) and Insufficiently Protec... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-100420 A sensitive information disclosure vulnerability in the cloud-client daemon of D... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote r... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114509 Laravel is a web application framework. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as im... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-82987 There exists a screen capture endpoint in vCast media streaming service in ViewS... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114139 Sentry-Javascript is an official Sentry SDKs for JavaScript. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114140 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various oth... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114141 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114142 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114143 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write ac... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-110803 VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then read... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105944 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on th... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-107588 Vaadin Charts renders charts with the Highcharts library and pins an exact versi... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105934 The Apache Pulsar broker admin REST API provides a truncate operation for persis... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105935 The Pulsar Functions Worker provides a REST API endpoint for triggering a functi... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105936 The Pulsar Functions worker REST API provides two endpoints that return the cata... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages o... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105931 The Apache Pulsar broker exposes a transaction administration REST API under /ad... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105932 The Apache Pulsar broker admin REST API provides endpoints to read, set and remo... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105933 Apache Pulsar allows an administrator to require end-to-end message encryption f... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114132 Nuxt is an open-source web development framework for Vue.js. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114126 Storybook is a frontend workshop for building user interface components and page... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114127 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114130 Nuxt is an open-source web development framework for Vue.js. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114125 Storybook is a frontend workshop for building user interface components and page... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-105930 When package management is enabled, Pulsar Functions, Sources and Sinks can be r... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-105869 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with al... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-105926 The Pulsar broker serves two schema commands on its binary protocol: GetSchema,... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105927 The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a d... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114463 The webhook platform gateway in Nous Research Hermes Agent versions builds the s... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114462 Improper link resolution before file access ('link following') vulnerability in... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113794 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.