October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107391 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-107392 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-13 |
| CVE-2026-106432 The BSON encoder in the MongoDB PHP Driver converts a string length to a 32-bit... |
high | 8.2 | — | Mongodb / php driver | 2026-10-08 | 2026-10-13 |
| CVE-2026-84276 IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerabi... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-12 |
| CVE-2026-84278 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 7.2 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-40804 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107701 dot-access through 1.0.0 contains a prototype pollution vulnerability that allow... |
high | 8.2 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107385 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107384 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106433 Improper state management in MongoDB libmongocrypt can cause provider-specific d... |
high | 8.8 | — | Mongodb / libmongocrypt | 2026-10-08 | 2026-10-27 |
| CVE-2026-106437 The BSON buffer-reservation API in the MongoDB C Driver can record a length smal... |
high | 7.4 | — | Mongodb / c driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-107322 An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS database... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107376 webonyx graphql-php is a PHP implementation of the GraphQL specification. |
high | 8.2 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107377 datamodel-code-generator generates Python data models from schema definitions. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina/file... |
high | 7.1 | — | — | 2026-10-08 | 2026-11-04 |
| CVE-2026-107375 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/ |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107302 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-107303 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 7.6 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsiste... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-50054 An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107300 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107709 A path traversal vulnerability exists in Bower decompress-zip through version 0.... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107295 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.6 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-105436 Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-ch... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-104077 Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability th... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-104078 Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bun... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-12 |
| CVE-2026-95208 An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfS... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-30 |
| CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14497 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14507 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticat... |
high | 7.7 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14905 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14496 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107639 ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument i... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107589 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107286 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-105830 league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of s... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105833 EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.