October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21114 Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allow... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21115 Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108982 VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104703 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-107761 Several Postiz endpoints return the complete database row of the record they ope... |
not reported | — | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108749 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-104841 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-97853 Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allo... |
not reported | — | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-103357 Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-i... |
not reported | — | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101947 ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command stri... |
not reported | — | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-16681 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-18524 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-22061 Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability th... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-103755 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108267 Privasys Go is a maintained fork of the Go programming language that adds RA-TLS... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108268 Enclave OS Virtual runs container workloads inside confidential virtual machines... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108269 Remote Attestation TLS Clients provides multi-language utilities for verifying a... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108266 Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62367 Vikunja is an open-source self-hosted task management platform. |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108265 Enclave OS Mini is a Rust-based runtime for confidential applications inside Int... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107852 Jexactyl is a customisable game management panel and billing system. |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108258 Shiny for Python is a framework for building interactive web applications in Pyt... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-104758 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-09 | 2026-10-18 |
| CVE-2025-8457 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107836 RIOT is an open-source microcontroller operating system designed for Internet of... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107824 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg tha... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java objec... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95702 Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-108125 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) a... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104115 A stack-based buffer overflow in the illumos reparse point daemon (reparsed) all... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd)... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-102916 A reachable assertion in the illumos bhyve instruction emulator allows a guest t... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireG... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a pack... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-8374 Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Se... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Ana... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.