October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cip... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104635 Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-98377 In the Linux kernel, the following vulnerability has been resolved:
vlan: requi... |
not reported | — | — | — | 2026-10-09 | 2026-10-21 |
| CVE-2026-98379 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98380 In the Linux kernel, the following vulnerability has been resolved:
net/sched:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98384 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ou... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-4264 Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, speci... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-98375 In the Linux kernel, the following vulnerability has been resolved:
xen/netfron... |
not reported | — | — | — | 2026-10-09 | 2026-10-21 |
| CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infe... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107802 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107733 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107734 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107735 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107736 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107737 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107738 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107732 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-105672 TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerab... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-105673 An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105674 TP-Link Tapo
C325WB V2 generates the pre-shared key used by its local media stre... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-100197 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-08 | 2026-10-16 |
| CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107725 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107716 Banks generates meaningful LLM prompts using a simple template language. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107406 Memory overflow vulnerability leading to Remote Code Execution or Denial of Serv... |
not reported | — | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-62181 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-16 |
| CVE-2026-102368 Affected Tapo device firmware stores device-specific cryptographic material in p... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107386 amqp091-go is a Go AMQP 0.9.1 client. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105570 Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when d... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-101998 Docker Sandboxes could fail open while masking credentials in protected proxy re... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105452 Docker Sandboxes could forward a client-supplied credential alongside a credenti... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-97147 In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve t... |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-93861 In OpenStack Mistral through 23.0.0, the workflow membership API lets a project... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-93858 In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93860 In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-62170 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-62171 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-107378 CairoSVG is an SVG converter based on Cairo, a 2D graphics library. |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62163 Rejected reason: Reason: This candidate is a duplicate of CVE-2026-60089. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-62166 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.