October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,859
Critical
1,275
High
5,585
Medium
5,949
Low
622
Severity not reported
3,428
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88964 An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and... |
not reported | — | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-53564 Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-15468 Authorization bypass through User-Controlled key vulnerability in HYPR Passwordl... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53563 Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This i... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-105142 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105151 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105390 Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5... |
not reported | — | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-104922 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-84419 Out-of-bounds write vulnerability in Citrix Workspace app for Windows. |
not reported | — | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-84420 Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-84790 OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonat... |
not reported | — | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-92088 Improper handling of undefined values vulnerability in upKeeper Solutions upKeep... |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-86063 Claude Code is an agentic coding tool. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-84994 Qwik is a performance-focused JavaScript framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-75120 The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Inve... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104816 Misskey is an open source, federated social media platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104817 Misskey is an open source, federated social media platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103937 Misskey is an open source, federated social media platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105445 An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organ... |
not reported | — | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-104011 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-66057 Frappe is a full-stack web application framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-55823 Frappe is a full-stack web application framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-53562 Improper link resolution before file access ('link following') vulnerability in... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-88836 Rejected reason: Red Hat Product Security determined this is not a security vuln... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69150 KeePassXC is a cross-platform community-driven port of the Windows application K... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54697 ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KState... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54700 ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KState... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102982 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103928 Metabase is an open source business intelligence and analytics platform. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-101899 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-97333 QAPI contained a stack-based buffer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97334 The network messaging layer contained improper handling of highly compressed dat... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-95117 Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote a... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77093 CvFWD contained an integer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77094 CvFWD contained an out-of-bounds write affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77095 CvFWD contained a null pointer dereference affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77096 CVFS contained a missing authentication condition affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77099 CVFS contained an input validation issue affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77100 MediaAgent contained a heap-based buffer overflow issue affecting service availa... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77090 CVFS contained an XML external entity (XXE) reference handling issue affecting i... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.