October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,444
Critical
1,335
High
5,831
Medium
6,240
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108265 Enclave OS Mini is a Rust-based runtime for confidential applications inside Int... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107852 Jexactyl is a customisable game management panel and billing system. |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108258 Shiny for Python is a framework for building interactive web applications in Pyt... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-104758 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-09 | 2026-10-18 |
| CVE-2025-8457 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107836 RIOT is an open-source microcontroller operating system designed for Internet of... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107824 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg tha... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java objec... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95702 Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-108125 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) a... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104115 A stack-based buffer overflow in the illumos reparse point daemon (reparsed) all... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd)... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-102916 A reachable assertion in the illumos bhyve instruction emulator allows a guest t... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireG... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a pack... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-8374 Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Se... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Ana... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cip... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104635 Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-98377 In the Linux kernel, the following vulnerability has been resolved:
vlan: requi... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-98379 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98380 In the Linux kernel, the following vulnerability has been resolved:
net/sched:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98384 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ou... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-4264 Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, speci... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-98375 In the Linux kernel, the following vulnerability has been resolved:
xen/netfron... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infe... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107802 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107733 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107734 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107735 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107736 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107737 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107738 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107732 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-105672 TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerab... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-105673 An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.