October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114113 Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabil... |
not reported | — | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-105044 Improper Neutralization of Special Elements used in an OS Command in Security To... |
not reported | — | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-6945 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113717 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113718 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113720 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113723 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113715 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-75747 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75751 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75997 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-48279 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-21266 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-21270 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-21356 Rejected reason: this CVE was issued in error. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113714 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113712 Cachet is an open-source status page system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113713 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113667 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113669 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113670 Rejected reason: This CVE is a duplicate of another CVE. |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113664 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-105772 Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113653 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113654 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-94192 A ThreadX module allocates the control blocks of its kernel objects from the Mod... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94202 The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` w... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-95107 A ThreadX module chooses `object_size` when it calls `txm_module_object_allocate... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-95108 One logical thread of a user-mode ThreadX module costs the Module Manager's shar... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-95109 The Cortex-A7 MMU Modules port validates a caller-supplied buffer by translating... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-92843 A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-92853 The TLS 1.3 Certificate-message parser in NetX Secure decrements the message len... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-93003 The Web add-on's HTTP server searches the entire request packet for header field... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-93475 The X.509 parser in NetX Secure accepts an RSA public key of any size, but every... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94018 The Web add-on's HTTP server dereferences and releases an uninitialized pointer... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94023 A ThreadX module reaches a kernel object's delete service through the Module Man... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94024 The Module Manager's object lookup validated one byte of a memory-protected modu... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-90800 Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91057 `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.