October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114519 Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from... |
not reported | — | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-93336 Missing authorization in the unit resources download route in Canonical Juju 4.0... |
not reported | — | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-115516 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-108357 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-108358 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-108359 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-97631 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Writ... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115502 A missing authorization check allows anyone having access to a "link without log... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-67597 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114606 draw.io Desktop is the official Electron build of draw.io. |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114608 Pylint is a static code analyser for Python. |
not reported | — | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-94482 Next.js is a React framework for building full-stack web applications. |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115450 External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and ch... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115453 Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishl... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115454 An excessive resource allocation issue in the remote workflow editing capabiliti... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115494 A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115496 Overly informative error messages in the catalog functionality of KNIME Business... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-16477 CleanShot X for macOS insecurely deserializes untrusted data embedded in a .clea... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-89409 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and ear... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-89410 In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOth... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-106017 Improper certificate validation in the OpenVPN 3 Core library version 3.4 throug... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoin... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log d... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-86696 Allocation of Resources Without Limits or Throttling vulnerability in esaml in d... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-93471 Improper Handling of Highly Compressed Data (Data Amplification) in esaml_bindin... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-110974 The org.json parser in com.vaadin.external.google:android-json recurses once per... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-105270 Allocation of Resources Without Limits or Throttling vulnerability in esaml_bind... |
not reported | — | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-89052 A hardcoded cryptographic key management vulnerability exists in Archer C6 due t... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-106053 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-103090 Missing Authentication for Critical Function (CWE-306) and Insufficiently Protec... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-100420 A sensitive information disclosure vulnerability in the cloud-client daemon of D... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114509 Laravel is a web application framework. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114139 Sentry-Javascript is an official Sentry SDKs for JavaScript. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114140 The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various oth... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114141 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114142 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114143 toml-node is a TOML parser for Node.js and the browser. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write ac... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.