October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110803 VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then read... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105944 Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on th... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-107588 Vaadin Charts renders charts with the Highcharts library and pins an exact versi... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-105934 The Apache Pulsar broker admin REST API provides a truncate operation for persis... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105935 The Pulsar Functions Worker provides a REST API endpoint for triggering a functi... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105936 The Pulsar Functions worker REST API provides two endpoints that return the cata... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages o... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105931 The Apache Pulsar broker exposes a transaction administration REST API under /ad... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-105932 The Apache Pulsar broker admin REST API provides endpoints to read, set and remo... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105933 Apache Pulsar allows an administrator to require end-to-end message encryption f... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114132 Nuxt is an open-source web development framework for Vue.js. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114126 Storybook is a frontend workshop for building user interface components and page... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114127 Astro is a web framework for content-driven websites. |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114130 Nuxt is an open-source web development framework for Vue.js. |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114125 Storybook is a frontend workshop for building user interface components and page... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-105930 When package management is enabled, Pulsar Functions, Sources and Sinks can be r... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-105869 Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with al... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-105926 The Pulsar broker serves two schema commands on its binary protocol: GetSchema,... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-105927 The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a d... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114462 Improper link resolution before file access ('link following') vulnerability in... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-113788 Lagoon is an application delivery platform for Kubernetes. |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-102536 Rejected reason: This CVE has been rejected because it was issued to a developme... |
not reported | — | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. |
not reported | — | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-104948 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-104947 WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vu... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114405 Improper validation of array index vulnerability in Velneo vServer. |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-105923 A malicious SVG can trigger an integer overflow which in turn triggers a null-po... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-70386 Improper neutralization of special elements used in an OS command ('OS command i... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability i... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-110938 In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable t... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111074 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerabl... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111075 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to per... |
not reported | — | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-82819 A vulnerability in Cerberus FTP Server allows an authenticated remote attacker t... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114197 Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114198 Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114111 sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vu... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114112 Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attacker... |
not reported | — | — | — | 2026-10-21 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.