October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105227 This vulnerability allows remote attackers to disclose sensitive information on... |
not reported | — | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105228 This vulnerability allows remote attackers to disclose sensitive information on... |
not reported | — | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-8311 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-18 |
| CVE-2026-5819 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-18 |
| CVE-2026-2937 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-18 |
| CVE-2026-107316 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-18 |
| CVE-2026-107172 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-18 |
| CVE-2025-3778 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-103910 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-63430 ammonia is a Rust library for repairing and securing untrusted HTML. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-47218 runwasi facilitates running Wasm and WASI workloads managed by containerd. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45165 An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated use... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108126 temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the names... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105660 Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel b... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104150 AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS fra... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-77466 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77467 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-77468 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-77470 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-61610 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-61838 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-62679 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-57569 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-57568 Lychee is a free, open-source photo-management tool. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102631 In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-102527 Nuxt OG Image generates OG Images with Vue templates in Nuxt. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97712 Sonatype Nexus Repository 3 allows a user that holds the role create or role upd... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97665 A missing authorization check in Nexus Repository 3's NuGet Components API uploa... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97666 Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-97667 Sonatype Nexus Repository 3 allows a user account that holds the edit permission... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-75505 EspoCRM is an open source customer relationship management application. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109449 In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105474 A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 t... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109413 In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-108082 Symfony is a PHP framework for web and console applications and a set of reusabl... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103508 P4 Search (formerly Helix Search) allows an authenticated user holding administr... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-103509 P4 Search (formerly Helix Search) returns stored credentials in cleartext throug... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110924 Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110927 Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.