October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. |
not reported | — | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-106447 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106448 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106512 The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constru... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106513 MISP exposes critical infrastructure settings—specifically the Redis host addres... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106439 Hydra is a framework for elegantly configuring complex applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106119 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-104944 TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-104945 TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-66666 Insertion of Sensitive Information Into Sent Data vulnerability in Automattic Wo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106106 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106107 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106109 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106104 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106105 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105805 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105806 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105844 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105804 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105794 MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2025-8352 Allocation of resources without limits or throttling vulnerability in ESET PROTE... |
not reported | — | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-34498 Improper input validation vulnerability in Johnson Controls Illustra Standard -... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2025-15591 Cross-site Scripting (XSS) in the Forums feature of OpenText Content Management... |
not reported | — | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75818 GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75819 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load()... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103831 CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-80327 An open redirect vulnerability exists in the PingGateway Fragment Filter feature... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-98370 In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix c... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98371 In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98372 In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98362 In the Linux kernel, the following vulnerability has been resolved:
clk: scpi:... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98363 In the Linux kernel, the following vulnerability has been resolved:
firmware: a... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98355 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs:... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98356 In the Linux kernel, the following vulnerability has been resolved:
RDMA/bnxt_r... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98358 In the Linux kernel, the following vulnerability has been resolved:
IB/iser: re... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98350 In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmf... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.