October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19572 A security vulnerability has been identified in FlexNet Publisher lmadmin. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripti... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pai... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models a... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-102478 In affected versions of Octopus Server, an authenticated user with permission to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19029 A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCC... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106547 A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. |
not reported | — | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-106447 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106448 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106512 The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constru... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106513 MISP exposes critical infrastructure settings—specifically the Redis host addres... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106439 Hydra is a framework for elegantly configuring complex applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106119 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-104944 TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-104945 TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-66666 Insertion of Sensitive Information Into Sent Data vulnerability in Automattic Wo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106106 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106107 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106109 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106104 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106105 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105805 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105806 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105844 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105804 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2025-8352 Allocation of resources without limits or throttling vulnerability in ESET PROTE... |
not reported | — | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-34498 Improper input validation vulnerability in Johnson Controls Illustra Standard -... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2025-15591 Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management... |
not reported | — | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75818 GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75819 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load()... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.