October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59667 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59668 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94634 Allocation of resources without limits or throttling, Initialization of a resour... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94635 Allocation of resources without limits or throttling, Improper handling of lengt... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94639 improper handling of exceptional conditions, Allocation of resources without lim... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-95662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59665 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59672 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59673 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59659 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59660 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59661 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59663 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59664 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91784 cjbassi/gotop is vulnerable to local argument injection via process termination... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59669 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59670 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59671 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-17508 In Bouncy Castle for Java before 1.86, several password-based key derivation ent... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % ope... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104480 Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resu... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-21140 Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 a... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Ne... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO F... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18397 This vulnerability enables unauthenticated remote code execution (RCE) on a vict... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-96780 figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Co... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55393 Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions thro... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55394 Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55395 Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55396 Cleartext transmission without a cryptographic integrity check in operator contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.