October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-54525 Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-55786 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 8.4 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-55787 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110770 Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability t... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110767 Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_que... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110769 holaOS through 2026.822.1 contains a missing authorization vulnerability in chan... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110667 A security flaw has been discovered in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110761 ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-102944 cpp-httplib is a C++ header-only HTTP/HTTPS library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-92158 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-92150 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-92154 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92155 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-88164 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-14 | 2026-10-20 |
| CVE-2026-86848 A flaw was found in DPDK lib/vhost vhost-crypto. |
high | 8.8 | — | — | 2026-10-14 | 2026-11-05 |
| CVE-2026-86567 A flaw was found in DPDK lib/vhost. |
high | 8.8 | — | — | 2026-10-14 | 2026-11-05 |
| CVE-2026-86461 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arb... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-79957 ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usua... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-54554 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109527 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-108480 Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploit... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108483 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108484 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108395 The Model Context Protocol Java SDK is the official Java SDK for Model Context P... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated re... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attac... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104103 Ludwig is a low-code framework for building custom LLMs, neural networks, and ot... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-103081 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102077 An Improper Check for Unusual or Exceptional Conditions vulnerability in the Pac... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101976 An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Jun... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101979 A Stack-based Buffer Overflow vulnerability in the authd Juniper Networks Junos... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101981 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101952 An Improper Validation of Consistency within Input vulnerability in the routing... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-101961 A NULL Pointer Dereference vulnerability in the routing-policy nexthop-ECMP matc... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101962 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101963 An Incorrect Calculation vulnerability in the routing protocol daemon (rpd) of J... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100413 SeaweedFS is a distributed storage system for files and blobs. |
high | 7.1 | — | Seaweedfs / seaweedfs | 2026-10-14 | 2026-10-29 |
| CVE-2026-101949 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-0322 Palo Alto Networks PAN-OS Code Injection Vulnerability |
high | 7.2 | Listed | Palo Alto Networks / PAN-OS | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.