October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Ne... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO F... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18397 This vulnerability enables unauthenticated remote code execution (RCE) on a vict... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-96780 figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Co... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55393 Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions thro... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55394 Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55395 Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55396 Cleartext transmission without a cryptographic integrity check in operator contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 al... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102514 Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, un... |
not reported | — | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2026-102370 Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-70650 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-71426 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71542 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55252 OpenRun is an open-source, self-hosted GitOps platform for deploying web apps an... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-14983 Missing authentication in the web interface in Teledyne FLIR Aware2 versions thr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-14984 Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/b... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-63721 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-63724 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-84682 A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) o... |
not reported | — | — | — | 2026-10-01 | 2026-10-23 |
| CVE-2026-27872 - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG all... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-9032 Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboard... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-73976 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-78577 Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan fu... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78578 Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboa... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103923 KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the we... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-102294 TP-Link TL-WR841N contains an authenticated OS command injection vulnerability i... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102369 Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanit... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-73975 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-94620 Classroom 50 is a free and open-source tool for managing and grading programming... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18734 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.