October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109758 Perforce Helix Authentication Service (HAS) deployments that retain the shipped... |
not reported | — | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-44828 Qexo is an open source online editor for static blogs. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-49483 Code for IBMi is a Visual Studio Code extension for maintaining and compiling IL... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-49484 Code for IBM i is a Visual Studio Code extension for maintaining and compiling I... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102539 Super Productivity is an advanced todo list app with integrated timeboxing and t... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-58462 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-84314 Nginx UI is a web user interface for the Nginx web server. |
not reported | — | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-95838 containerd is an open-source container runtime. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108362 Privasys Remote Attestation TLS Clients provides multi-language utilities for ve... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108361 Privasys Remote Attestation TLS Clients provides multi-language utilities for ve... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2021-48009 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-89140 Temporal Server does not bind internal completion callbacks to the namespace tha... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103061 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104102 copyparty is a portable file server. |
not reported | — | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104355 A connected peer cluster can modify a Temporal Server cluster's local namespaces... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-6232 An out-of-bounds write vulnerability in the SPI host command interface of Semtec... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109222 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105274 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-92681 In @neo4j/graphql versions up to and including 7.6.3, @authentication directives... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92682 In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none qu... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96612 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-96618 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability i... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-81856 Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in h... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103503 Improper Certificate Validation vulnerability in hexpm hex allows an attacker wh... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105280 Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105668 Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a pa... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103060 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92877 The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSIN... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-68764 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-103502 Improper Certificate Validation vulnerability in hexpm hex_core allows an attack... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105283 Generation of Error Message Containing Sensitive Information vulnerability in as... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108979 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-1907 A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clu... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104710 Rejected reason: Duplicate of CVE-2026-71364, which was publicly disclosed and f... |
not reported | — | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-21133 Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21134 Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacen... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21135 Improper access control in Samsung Internet prior to version 30.0.5.6 allows loc... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21136 Improper authorization in Smart Switch prior to version 3.7.73 allows physical a... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21137 Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21138 Insufficient verification of data authenticity in Smart Switch prior to version... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.