October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-64818 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-02 | 2026-10-16 |
| CVE-2026-104855 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104859 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104854 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104853 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104912 MISP contains an authorization flaw in its correlation handling during attribute... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104914 MISP contains an improper access control vulnerability in its attribute search a... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104906 MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object vie... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104907 MISP contains a cross-site scripting (XSS) vulnerability in the remote event pre... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104908 MISP contains an improper input validation vulnerability in the decaying model i... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104910 MISP contains an authorization bypass in the related events listing functionalit... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104847 ProseMirror's view component renders and manages the editable browser interface... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104900 MISP contains a stored cross-site scripting (XSS) vulnerability in the index tab... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104901 MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator fe... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104843 uv is a Python package and project manager written in Rust. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104721 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-cla... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96277 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96286 Uncaught exception vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96287 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96289 Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94658 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94655 Allocation of resources without limits or throttling, Inefficient Algorithmic Co... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94656 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94657 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94654 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85476 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83632 Allocation of resources without limits or throttling, Integer overflow or wrapar... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83663 Uncontrolled Recursion vulnerability in Apache Thrift go bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-83745 Memory allocation with excessive size value, Improper handling of length paramet... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66081 Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66331 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-66837 Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apa... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66858 The protocol skip routine in several Apache Thrift bindings did not apply the bi... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-66859 NULL Pointer Dereference, Use of Uninitialized Variable vulnerability in Apache... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-61374 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-63772 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.