October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63277 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the l... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63268 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it p... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59788 The email media type OAuth form passes the Authorization endpoint value to windo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59782 The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerabili... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59783 The Zabbix Server/Proxy has a vulnerability where binary items can crash the Ser... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59785 Host search in Frontend allows filtering by fields that are not displayed, inclu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59787 The Perl SNMP trap receiver script shipped with Zabbix does not properly neutral... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause th... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerab... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functiona... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103511 Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to it... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103512 Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when valid... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103335 Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajrac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written throug... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authenticati... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authenti... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105301 Rejected reason: This candidate was rejected after further investigation determi... |
not reported | — | — | — | 2026-10-05 | 2026-10-21 |
| CVE-2026-105214 Zitadel before 4.16.2 contains a server-side request forgery vulnerability that... |
not reported | — | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authori... |
not reported | — | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97873 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a dat... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parse... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - or... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through tw... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.