October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execu... |
not reported | — | — | — | 2026-10-07 | 2026-10-24 |
| CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft T... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclip... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107102 This vulnerability exists in the ERP system due to improper validation of paymen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107103 This vulnerability exists in the ERP system due to insufficient validation and p... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64391 This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-19572 A security vulnerability has been identified in FlexNet Publisher lmadmin. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripti... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pai... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models a... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-102478 In affected versions of Octopus Server, an authenticated user with permission to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19029 A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCC... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106547 A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106445 Handlebars provides the power necessary to let users build semantic templates. |
not reported | — | — | — | 2026-10-06 | 2026-10-12 |
| CVE-2026-106447 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106448 StableLib is a stable library of useful TypeScript and JavaScript code. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106512 The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constru... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106513 MISP exposes critical infrastructure settings—specifically the Redis host addres... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106439 Hydra is a framework for elegantly configuring complex applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106119 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106120 LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScri... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-104944 TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-104945 TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in it... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-66666 Insertion of Sensitive Information Into Sent Data vulnerability in Automattic Wo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106106 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106107 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106109 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106104 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-106105 Quasar Framework is a framework for building high-performance Vue.js user interf... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105805 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105806 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105844 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-105804 Payload is a free and open source headless content management system. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105799 LangChain is a framework for building LLM-powered applications. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105801 openapi-python-client generates Python clients from OpenAPI documents. |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.