October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,116
Critical
1,298
High
5,694
Medium
6,075
Low
636
Severity not reported
3,413
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115776 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-115778 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79982 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/de... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79977 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endp... |
high | 8.2 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79979 The arm64 MMU backend invalidates a single virtual address from the TLB with inv... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with defau... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115570 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112342 Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/h... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115863 ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message... |
high | 7.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110975 A flaw was found in Kruize Autotune. |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-87901 Improper sanitization in the registration module allows reflected Cross-Site Scr... |
high | 8.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115810 Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerabilit... |
high | 7.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be si... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-105483 A flaw in Node.js TLS hostname verification allows a certificate without a match... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnera... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-50787 e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2025-45528 An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local at... |
high | 7.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-55457 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-39902 Cacti is an open source performance and fault management framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-106763 An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to e... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106764 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbit... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-106765 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute ar... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-93631 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Coll... |
high | 7.1 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-93639 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93640 A local privilege escalation vulnerability in the optional dnscache package of Z... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-50053 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) a... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimb... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-50057 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZC... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-114621 baserCMS is a website development framework. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-114622 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114624 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115457 baserCMS is a website development framework. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-10632 A reflected cross-site scripting vulnerability in the Classic Web Client of Zimb... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-99081 In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fi... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99082 In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: U... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99083 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99077 In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp:... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.