October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,016
Critical
1,287
High
5,651
Medium
6,028
Low
636
Severity not reported
3,414
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (735), oracle (150), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112064 The backend module for reviewing the consent history accepted sorting, grouping... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112065 The routes that provide consent history and statistics data did not check whethe... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112066 The JSON import of the cookie consent configuration did not respect the backend... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112067 The extension hides the correct answer to each CAPTCHA inside the image data of... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43846 A stack-based buffer overflow vulnerability in a non-functional feature could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43847 A vulnerability in the proprietary protocol could allow an attacker to brute for... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43848 A vulnerability in the bulk port configuration functionality could allow an unau... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43837 A buffer overflow vulnerability in the password verification functionality could... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43838 A stack-based buffer overflow vulnerability in the login functionality could all... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43839 A NULL pointer dereference vulnerability in the logs management functionality co... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43840 A NULL pointer dereference vulnerability in the license manager service could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-43841 A NULL pointer dereference vulnerability in the license manager service could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43842 A NULL pointer dereference vulnerability in the license manager service could al... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43843 An integer overflow vulnerability in the license manager service could allow an... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43844 A vulnerability in the proprietary protocol could allow an attacker to bypass th... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43845 A vulnerability in the password reset mechanism could allow an attacker to bypas... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-11959 Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-11960 Enumeration of unauthenticated users in FacturaScripts, version 2025.61. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43836 A vulnerability could allow an attacker to forge a packet to execute arbitrary c... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-101201 A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can c... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43834 A stack-based buffer overflow vulnerability in the logs settings functionality c... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43835 A vulnerability in the firmware upgrade functionality could allow an authenticat... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112148 A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0,... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113380 In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-17518 Buffer Copy without Checking Size of Input in certain ASUS router models allows... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75753 Missing Authentication for a Critical Function in certain ASUS routers allows an... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-102438 An uncontrolled search path element vulnerability in ASUS Armoury Crate allows l... |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-86944 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-86959 An input validation issue was addressed with improved input validation. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-84579 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-84582 A privacy issue was addressed with improved access restrictions. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-105298 Summary
Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host heade... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112991 The html_to_markdown expansion module in MISP Modules contains a server-side req... |
not reported | — | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-56714 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57512 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57513 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57514 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57515 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57519 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-57526 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-19 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.