October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114213 Allocation of Resources Without Limits or Throttling vulnerability in the WebSoc... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114216 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111590 A wide range of Harbor versions allow SSRF via its webhook delivery component wh... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112880 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Respons... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113436 Inefficient Algorithmic Complexity vulnerability in the header integer parser of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113440 Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney... |
not reported | — | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-111101 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111103 Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtru... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110474 This vulnerability exists in the CreditNirvana Agentic AI Call Centre applicatio... |
not reported | — | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-110475 This vulnerability exists in the CreditNirvana Collections Platform due to impro... |
not reported | — | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-110499 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-109584 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110314 Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket c... |
not reported | — | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-108525 Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108529 Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-107157 Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework. |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-96432 A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_S... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2012-20006 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-4316 Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-103377 A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116372 MISP mispguard is a security filtering proxy that inspects and blocks MISP feed... |
not reported | — | — | — | 2026-10-26 | 2026-11-02 |
| CVE-2026-115425 Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall ves... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-96581 Authorization Bypass Through User-Controlled Key vulnerability in ash-project as... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115627 Incorrect Authorization vulnerability in ash-project ash_postgres allows a user... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115635 Incorrect Authorization vulnerability in ash-project ash_postgres allows a user... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-114214 Incorrect Authorization vulnerability in ash-project ash allows a client to read... |
not reported | — | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116184 OpenRemote before 1.31.0 contains an authorization bypass vulnerability that all... |
not reported | — | — | — | 2026-10-25 | 2026-11-04 |
| CVE-2026-116186 OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116164 Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject rese... |
not reported | — | — | — | 2026-10-25 | 2026-11-04 |
| CVE-2026-116165 Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing a... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116161 Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an informat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116162 Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire log... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-89284 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
| CVE-2026-111326 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
| CVE-2026-109111 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-24 | 2026-10-24 |
| CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" modu... |
not reported | — | — | — | 2026-10-24 | 2026-11-02 |
| CVE-2026-110814 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-108537 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-108793 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.