October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63442 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-71490 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58390 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-53582 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45450 : Improper Restriction of Operations within the Bounds of a Memory Buffer vulner... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45451 : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/U... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45452 Use of Externally-Controlled format string vulnerability in Unitronics Unitronic... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45449 : Improper Neutralization of Special Elements used in an OS Command ('OS Command... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untruste... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the rep... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100351 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-9703 Grafana's data source proxy did not apply role-based access control to write req... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95179 An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attack... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-79838 A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79839 A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory c... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79840 A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corrupt... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-53574 EspoCRM is an open source customer relationship management application. |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110746 A local privilege escalation vulnerability in TotalAV allows an unprivileged loc... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter... |
high | 7.5 | — | Progress / kendo ui | 2026-10-15 | 2026-10-20 |
| CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-79837 A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109692 Missing Authorization vulnerability in ThemeGrill User Registration user-registr... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109693 Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fl... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109702 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110723 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109685 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-107416 Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79834 A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticat... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79832 A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potenti... |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79833 A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated a... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109695 Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108491 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108498 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79829 A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corrupti... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79824 A directory traversal vulnerability in HPE NonStop Python 3.x could allow attack... |
high | 8.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79825 A heap buffer overflow in HPE NonStop NDSREST could corrupt resume-execution add... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79826 A heap buffer overflow in HPE NonStop OCAX could corrupt address space and may p... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79827 A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-exe... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.