October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59787 The Perl SNMP trap receiver script shipped with Zabbix does not properly neutral... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause th... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerab... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functiona... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103511 Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to it... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103512 Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when valid... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103335 Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajrac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written throug... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authenticati... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authenti... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105301 Rejected reason: This candidate was rejected after further investigation determi... |
not reported | — | — | — | 2026-10-05 | 2026-10-21 |
| CVE-2026-105214 Zitadel before 4.16.2 contains a server-side request forgery vulnerability that... |
not reported | — | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authori... |
not reported | — | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97873 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a dat... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parse... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - or... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through tw... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 94... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API ac... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105090 Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-79113 OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105050 PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS comman... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104886 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104887 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-75937 A specially crafted HTTP POST request to the web administration interface allows... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104055 The postgresql-operator charm runs a Prometheus postgres_exporter to collect dat... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104873 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.