October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78669 A malicious HTTP/2 peer can cause excessive CPU consumption in the client or ser... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83943 Exposure of sensitive information to an unauthorized actor in Azure API Center a... |
high | 8.7 | — | — | 2026-10-08 | 2026-10-31 |
| CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request an... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-94440 Parsing a multipart form can bypass memory limits and read an arbitrarily long l... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78667 When parsing a Range header containing a large number of small ranges, FileServe... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-69435 Missing authorization in Azure SRE Agent allows an authorized attacker to elevat... |
high | 8.1 | — | Microsoft / azure sre agent | 2026-10-08 | 2026-10-15 |
| CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Bod... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107728 Strawberry GraphQL is a library for creating GraphQL APIs. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-89091 A flaw was found in ansible-core. |
high | 8.8 | — | — | 2026-10-08 | 2026-11-05 |
| CVE-2026-84875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 8.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84891 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84032 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a m... |
high | 8.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-107720 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107723 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 8.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107724 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-95116 An issue in libming through 0.4.8 allows a remote attacker to cause a denial of... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-78388 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-19491 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19493 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-12 |
| CVE-2026-19498 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-16823 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-16916 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-18740 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-19482 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 8.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-12109 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.2 | — | Ibm / security verify access | 2026-10-08 | 2026-11-04 |
| CVE-2026-11888 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-11930 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
| CVE-2026-107781 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107782 System Informer before 4.0.26241.138 contains an incorrect authorization vulnera... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-11318 Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-101024 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal v... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107318 @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HT... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-84275 IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM fil... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84245 IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84250 IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protec... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84271 IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypa... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-107707 Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerabi... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107390 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.