October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,417
Critical
1,331
High
5,820
Medium
6,228
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-36436 An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in pla... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111231 Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111224 pfSense CE through 2.9.0 contains an OS command injection vulnerability in the O... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 8.8 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111226 pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability th... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111229 pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in ser... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111217 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111219 Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in s... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111220 pfSense CE through 2.9.0 contains a crontab injection vulnerability in interface... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111221 Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerabilit... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111222 Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulner... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111215 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111216 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111160 LightLLM through 1.2.0 contains a denial of service vulnerability that allows un... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111124 CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in... |
high | 7.1 | — | Nasa / cfitsio | 2026-10-15 | 2026-10-26 |
| CVE-2026-111125 CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in... |
high | 7.1 | — | Nasa / cfitsio | 2026-10-15 | 2026-10-21 |
| CVE-2026-109924 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109932 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109841 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109869 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-108334 A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant op... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-104828 HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. |
high | 7.2 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-104827 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55103 Discourse ActivityPub adds ActivityPub support to Discourse. |
high | 8.6 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-55246 bincookie is a header-only binarycookies parser. |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111105 Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103936 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-85634 A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of th... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-61611 Lychee is a free, open-source photo-management tool. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-105065 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-100353 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100409 OpenNext Cloudflare is an open Next.js adapter for Cloudflare. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97394 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-95155 FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-92982 A flaw was found in Ansible Operator Plugins. |
high | 8.5 | — | — | 2026-10-15 | 2026-10-30 |
| CVE-2026-88753 A Regular-Expression Denial of Service (ReDoS) in the Markdown2. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.