October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86471 An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on... |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-90797 An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and be... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-90798 A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-90799 Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112953 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112945 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112946 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112947 Vite is a frontend tooling framework for JavaScript. |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-111763 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-107755 Insufficient filtering of credentials in the _replicator database in Apache Couc... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-96402 A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffe... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-97400 In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91186 The PNG chunk reader has no notion of chunk ordering. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91189 The GUIX binary resource loader never checks that a font page's glyph range is w... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-92162 Flatpak is a system for building, distributing, and running sandboxed desktop ap... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-92446 `gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-92449 `_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader in... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-95111 A memory-protected ThreadX module's queue request reaches the Module Manager's d... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-91059 The GUIX JPEG software decoder enforces no ordering on JPEG markers. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112942 launch-editor allows users to open files with line numbers in editor from Node.j... |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.j... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.j... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111762 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-101296 A missing critical step in authentication vulnerability in Apache Tomcat when th... |
not reported | — | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-14933 Cross-site scripting in the embedded co-browsing feature in Unblu inc. |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-9589 Missing authorization in the configuration cascade operations of the Collaborati... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-108062 Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyn... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-107597 PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC disc... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-85267 A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-2... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43851 A path traversal vulnerability could allow an authenticated attacker to read arb... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43852 A vulnerability could allow an authenticated attacker to write files to arbitrar... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43853 A vulnerability could allow an attacker to send a crafted message to trigger an... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43854 A vulnerability could allow an attacker with access to an encrypted project file... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43855 A heap-based buffer overflow vulnerability could allow a remote authenticated at... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43856 A stack-based buffer overflow vulnerability in the FileProcess::CheckDir functio... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43857 A vulnerability could allow a remote authenticated attacker to achieve arbitrary... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-43858 A stack-based buffer overflow vulnerability could allow a remote authenticated a... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113442 Values entered by visitors were placed into the HTML summary email without being... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113459 In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedde... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113468 The payment notification endpoint for PayPal accepts incoming data without verif... |
not reported | — | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.