October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,068
Critical
1,296
High
5,672
Medium
6,054
Low
636
Severity not reported
3,410
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (744), oracle (154), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113791 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113792 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-113793 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113788 Lagoon is an application delivery platform for Kubernetes. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-113789 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113790 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-102536 Rejected reason: This CVE has been rejected because it was issued to a developme... |
not reported | — | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-104948 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-104947 WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vu... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2025-0326 The system fails to invalidate existing access tokens associated with sub-organi... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-86249 On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_p... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114405 Improper validation of array index vulnerability in Velneo vServer. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-78048 A reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-78058 Uncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-78066 Resource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-78334 Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-79704 An out-of-bounds read vulnerability exists in the streaming RPC client of Apache... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-59562 Missing authentication for critical function vulnerability in Apache IoTDB. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-66392 Apache bRPC versions before 1.18.0 validate the server certificate chain when cl... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-74755 An integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-74758 A heap use-after-free in the RTMP protocol component of Apache bRPC (versions <... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-41114 Uncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-58663 An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105923 A malicious SVG can trigger an integer overflow which in turn triggers a null-po... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-70386 Improper neutralization of special elements used in an OS command ('OS command i... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability i... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-110938 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable t... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111074 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerabl... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111075 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to per... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-82819 A vulnerability in Cerberus FTP Server allows an authenticated remote attacker t... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114197 Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114198 Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114111 sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vu... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114112 Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attacker... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114113 Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabil... |
not reported | — | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-105044 Improper Neutralization of Special Elements used in an OS Command in Security To... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-6945 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113212 Memory corruption in PDF in Google Chrome prior to 156.0.8078.47 allowed a remot... |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a
`username:passw... |
not reported | — | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.