October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62167 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105823 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105824 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105825 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105826 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105827 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105828 Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an in... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105400 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105401 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105402 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105403 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105404 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105405 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105331 Local privilege escalation in Checkmk 2.5.0 before 2.5.0p10 allows a user with a... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105398 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-105399 Rejected reason: This CVE ID has been rejected as a duplicate. |
not reported | — | — | — | 2026-10-08 | 2026-10-18 |
| CVE-2026-88257 Improper Input Validation vulnerability in BeamMCP.Schema in ScriptKittyOS beam_... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103663 Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insuff... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104634 Incorrect Type Conversion or Cast vulnerability in BeamMCP.Server in ScriptKitty... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102784 Joomla Extension - balbooa.com - CSRF in language installation feature Gridbox <... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102783 Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107503 In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-12260 SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable co... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-4894 A vulnerability has been identified regarding insufficient validation in the Fra... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93699 Argument injection in WP Toolkit for cPanel allows local users to execute arbitr... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102488 In affected versions, Octopus Server incorrectly evaluates multiple scoped permi... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-97664 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-07 | 2026-10-16 |
| CVE-2026-107282 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107231 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107279 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107280 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107281 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the proj... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97715 CVE-2026-97715 is
a vulnerability in the client registration process of Secure A... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97716 CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97717 CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access serve... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97714 CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secur... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107354 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107355 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allo... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.