October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0482 In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103433 Docker Buildx Bake does not request the expected fs.read approval for certain fi... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-84900 Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105699 Langflow is a tool for building and deploying AI-powered agents and workflows. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105768 apko allows users to build and publish OCI container images built from apk packa... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94201 Ash stores :atom-typed attributes as strings and compares them as strings. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105689 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105686 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97305 Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI C... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97309 Missing Authorization vulnerability in Webful Creations RepairBuddy computer-rep... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97070 Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Coz... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93322 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93323 The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93318 A malicious image can advertise DiffIDs from another image while containing diff... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93319 A malicious external BuildKit frontend can send requests using the internal API... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93316 If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93317 An unauthenticated attacker controlling a registry or OCI-layout blob source cou... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105632 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104976 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-86671 In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104966 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104968 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104892 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63277 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the l... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63268 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it p... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59788 The email media type OAuth form passes the Authorization endpoint value to windo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59782 The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerabili... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59783 The Zabbix Server/Proxy has a vulnerability where binary items can crash the Ser... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59785 Host search in Frontend allows filtering by fields that are not displayed, inclu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.