October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,410
Critical
3,098
High
6,954
Medium
6,692
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95105 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integr... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75818 GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75819 GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load()... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-75820 GNU Aspell contains an integer truncation vulnerability in the WritableDict::add... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through tw... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 94... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API ac... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a dat... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parse... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - or... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97873 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105768 apko allows users to build and publish OCI container images built from apk packa... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-73975 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-103923 KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the we... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-70650 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-105214 Zitadel before 4.16.2 contains a server-side request forgery vulnerability that... |
not reported | — | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-104859 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-105632 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104968 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-79701 Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass in Module Con... |
not reported | — | — | — | 2026-09-14 | 2026-10-05 |
| CVE-2026-96990 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94652 Missing release of memory after effective lifetime vulnerability in Apache Thrif... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94653 Inefficient Algorithmic Complexity vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94639 improper handling of exceptional conditions, Allocation of resources without lim... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94642 Uncaught exception vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94644 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94645 Improper validation of specified quantity in input, Allocation of resources with... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94637 Improper handling of highly compressed data (data amplification) vulnerability i... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94638 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-94648 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59659 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59660 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-59661 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-61373 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-104892 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.