October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71854 OpenAEV is an open source platform allowing organizations to plan, schedule and... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-45449 : Improper Neutralization of Special Elements used in an OS Command ('OS Command... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-100409 OpenNext Cloudflare is an open Next.js adapter for Cloudflare. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103936 libp2p is a JavaScript implementation of the libp2p networking stack. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-55246 bincookie is a header-only binarycookies parser. |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104827 react/http is an event-driven, streaming HTTP client and server implementation f... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97370 Junrar is an open source Java RAR archive library. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109119 Improper Privilege Management in the user management API endpoint (/api/users/{u... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107564 An unauthenticated remote attacker may use an allocation of resources without li... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buff... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge mes... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or trunc... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-48503 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104103 Ludwig is a low-code framework for building custom LLMs, neural networks, and ot... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write req... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-42269 countly-server is the server-side part of Countly, a product analytics solution. |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-42270 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85817 Reliance on untrusted inputs in a security decision in Windows PowerShell allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85820 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108913 omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-pa... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108980 Blinko through 1.8.8 allows directory traversal, overwriting startup files as ro... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108985 ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-65198 Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both au... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95114 libwebsockets contains an out-of-bounds read vulnerability in the LEJP increment... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95115 Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote att... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95121 An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95122 mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::Genera... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95124 Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110359 Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege e... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110449 Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant o... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105429 Improper neutralization of special elements in the NetBird client SSH configurat... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the
af... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95179 An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attack... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45450 : Improper Restriction of Operations within the Bounds of a Memory Buffer vulner... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45451 : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/U... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45452 Use of Externally-Controlled format string vulnerability in Unitronics Unitronic... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95155 FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-36436 An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in pla... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106700 ELADMIN v2.7 and earlier contains an improper access control vulnerability in th... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.