October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,432
Critical
1,333
High
5,825
Medium
6,236
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100353 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100409 OpenNext Cloudflare is an open Next.js adapter for Cloudflare. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97394 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-95155 FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-92982 A flaw was found in Ansible Operator Plugins. |
high | 8.5 | — | — | 2026-10-15 | 2026-10-30 |
| CVE-2026-88753 A Regular-Expression Denial of Service (ReDoS) in the Markdown2. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-63442 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-71490 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58390 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-53582 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45450 : Improper Restriction of Operations within the Bounds of a Memory Buffer vulner... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45451 : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/U... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45452 Use of Externally-Controlled format string vulnerability in Unitronics Unitronic... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45449 : Improper Neutralization of Special Elements used in an OS Command ('OS Command... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untruste... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the rep... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100351 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write req... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95179 An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attack... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-79838 A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79839 A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory c... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79840 A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corrupt... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-53574 EspoCRM is an open source customer relationship management application. |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110746 A local privilege escalation vulnerability in TotalAV allows an unprivileged loc... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter... |
high | 7.5 | — | Progress / kendo ui | 2026-10-15 | 2026-10-20 |
| CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-79837 A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109692 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109693 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109685 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-107416 Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79834 A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticat... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79832 A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potenti... |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79833 A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated a... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109695 Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.