October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93783 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-93784 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
not reported | — | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-19445 A remote, unauthenticated TLS client can make a server crash or call
through a f... |
not reported | — | — | — | 2026-09-30 | 2026-10-03 |
| CVE-2026-104886 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104887 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-71448 : Insecure Default Initialization of Resource vulnerability in Johnson Controls... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71453 - External Control of File Name or Path vulnerability in Johnson Controls EasyIO... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71454 Improper neutralization of input during web page generation ('cross-site scripti... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64892 - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Ne... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18397 This vulnerability enables unauthenticated remote code execution (RCE) on a vict... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71451 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Co... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO F... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS C... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 al... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-27873 - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104480 Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resu... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-21140 Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 a... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86325 A stack-based buffer overflow vulnerability exists in protocol gateways' account... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-86326 An improper verification of cryptographic signature vulnerability exists in prot... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91784 cjbassi/gotop is vulnerable to local argument injection via process termination... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94620 Classroom 50 is a free and open-source tool for managing and grading programming... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102370 Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-96780 figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfo... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104843 uv is a Python package and project manager written in Rust. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104847 ProseMirror's view component renders and manages the editable browser interface... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-73976 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96292 Inefficient regular expression complexity, Inefficient Algorithmic Complexity vu... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-95662 Cross-Site Scripting vulnerability in the Repasat application. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94654 Loop with unreachable exit condition ('infinite loop') vulnerability in Apache T... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94655 Allocation of resources without limits or throttling, Inefficient Algorithmic Co... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94656 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94657 Allocation of resources without limits or throttling vulnerability in Apache Thr... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94658 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96287 Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91775 LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled c... |
not reported | — | — | — | 2026-09-23 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.