October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,254
Critical
1,318
High
5,767
Medium
6,150
Low
636
Severity not reported
3,383
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59659 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59660 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59661 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59663 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59664 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91784 cjbassi/gotop is vulnerable to local argument injection via process termination... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59669 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59670 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-59671 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-17508 In Bouncy Castle for Java before 1.86, several password-based key derivation ent... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-18036 In Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % ope... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104480 Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resu... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-21140 Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 a... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Ne... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO F... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18397 This vulnerability enables unauthenticated remote code execution (RCE) on a vict... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-96780 figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Co... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55393 Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions thro... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55394 Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55395 Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55396 Cleartext transmission without a cryptographic integrity check in operator contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 al... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102514 Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, un... |
not reported | — | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2026-102370 Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-70650 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-71426 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71542 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55252 OpenRun is an open-source, self-hosted GitOps platform for deploying web apps an... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-14983 Missing authentication in the web interface in Teledyne FLIR Aware2 versions thr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-14984 Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.