October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104758 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-09 | 2026-10-18 |
| CVE-2025-8457 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107836 RIOT is an open-source microcontroller operating system designed for Internet of... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107824 x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg tha... |
not reported | — | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-102554 Allocation of resources without limits or throttling (CWE-770) during Java objec... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95702 Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-108125 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104112 A missing release of resources in the illumos name service cache daemon (nscd) a... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104113 A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104114 A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104115 A stack-based buffer overflow in the illumos reparse point daemon (reparsed) all... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104116 A missing authorization check in the illumos zones statistics daemon (zonestatd)... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104117 A missing authorization check in the illumos IP management daemon (ipmgmtd) allo... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-102916 A reachable assertion in the illumos bhyve instruction emulator allows a guest t... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107785 Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireG... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106581 Before 4.92.0, Docker Desktop for Windows did not verify the signature of a pack... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-8374 Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Se... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-105877 Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Ana... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-71884 In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cip... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-104635 Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf... |
not reported | — | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-98377 In the Linux kernel, the following vulnerability has been resolved:
vlan: requi... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-98379 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98380 In the Linux kernel, the following vulnerability has been resolved:
net/sched:... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-98384 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix ou... |
not reported | — | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-4264 Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, speci... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-98375 In the Linux kernel, the following vulnerability has been resolved:
xen/netfron... |
not reported | — | — | — | 2026-10-09 | 2026-10-30 |
| CVE-2026-101028 Incorrect Authorization vulnerability in ash-project ash allows an actor to infe... |
not reported | — | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107802 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107733 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107734 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107735 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107736 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107737 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-107738 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107732 SumatraPDF is a multi-format reader for Windows. |
not reported | — | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-105672 TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerab... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-105673 An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in t... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105674 TP-Link Tapo
C325WB V2 generates the pre-shared key used by its local media stre... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-100197 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-08 | 2026-10-16 |
| CVE-2026-107726 Hazelcast is a unified real-time data platform combining stream processing with... |
not reported | — | — | — | 2026-10-08 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.