October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-21139 Improper access control in Samsung Continuity Service for windows prior to versi... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21125 Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21126 Improper input validation in getting cover image in libsimba.heifdec.media.samsu... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21127 Improper export of android application components in Samsung Account prior to ve... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21128 Improper input validation in CreditCardRegisterActivity of Samsung Checkout prio... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21129 Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21130 Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prio... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21131 Incorrect default permission in Samsung Flow prior to version 4.9.22.4 allows lo... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21132 Improper input validation in Samsung Internet prior to version 30.0.5.24 allows... |
not reported | — | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-21116 Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allow... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21117 Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 al... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21118 Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allo... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21119 Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21120 Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attac... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21121 Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Re... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21122 Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows l... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21123 Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 al... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-21124 Improper input validation in getting cover image in libsimba.heifdec.media.samsu... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21114 Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allow... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21115 Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108982 VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to... |
not reported | — | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104703 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-107761 Several Postiz endpoints return the complete database row of the record they ope... |
not reported | — | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-108749 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2026-104841 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-97853 Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allo... |
not reported | — | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-103357 Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-i... |
not reported | — | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-101947 ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command stri... |
not reported | — | — | — | 2026-10-10 | 2026-10-15 |
| CVE-2026-16681 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-18524 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-22061 Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability th... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-103755 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108267 Privasys Go is a maintained fork of the Go programming language that adds RA-TLS... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108268 Enclave OS Virtual runs container workloads inside confidential virtual machines... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108269 Remote Attestation TLS Clients provides multi-language utilities for verifying a... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108266 Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62367 Vikunja is an open-source self-hosted task management platform. |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108265 Enclave OS Mini is a Rust-based runtime for confidential applications inside Int... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107852 Jexactyl is a customisable game management panel and billing system. |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108258 Shiny for Python is a framework for building interactive web applications in Pyt... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.