October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,345
High
5,918
Medium
6,294
Low
651
Severity not reported
3,273
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1335), google (757), oracle (211), ibm (140), adobe (138), apple (85), broadcom (61), langflow (57), apache (47), freerdp (42)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.