October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98167 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98168 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-10-06 | 2026-10-21 |
| CVE-2026-98170 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-10-06 | 2026-10-30 |
| CVE-2026-98172 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
not reported | — | — | — | 2026-10-06 | 2026-10-30 |
| CVE-2026-95105 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integr... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-98165 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-4889 SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-66588 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-94206 Use of Password Hash With Insufficient Computational Effort vulnerability in dan... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39768 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-39725 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2026-104399 Insertion of Sensitive Information Into Sent Data vulnerability in StylemixTheme... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-85153 This vulnerability exists in the Schmooze app due to the use of hardcoded creden... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59357 Insufficient verification of data authenticity (CWE-345) in the external OIDC lo... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-59358 Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry U... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105786 Joplin is an open source note-taking and to-do application that organises notes... |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105764 Immich is a high-performance self-hosted photo and video management solution. |
not reported | — | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-104852 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-91107 openSIS Classic 9.3 allows an authenticated user with the built-in teacher role... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93315 When proxy networking with CA injection is enabled, a build can modify its CA bu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93321 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0482 In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103433 Docker Buildx Bake does not request the expected fs.read approval for certain fi... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-0461 Insufficient boundary validation in the USB boot mode implementation of AMD Zynq... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-84900 Previous versions of HP ThinPro (prior to HP ThinPro 8.1 SP10) could potentially... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93326 A build step for a Git source, crafted in a specific way, can bypass some policy... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105699 Langflow is a tool for building and deploying AI-powered agents and workflows. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105768 apko allows users to build and publish OCI container images built from apk packa... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94201 Ash stores :atom-typed attributes as strings and compares them as strings. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105689 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-08 |
| CVE-2026-105686 Penpot is an open-source design and prototyping platform. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97305 Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI C... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97309 Missing Authorization vulnerability in Webful Creations RepairBuddy computer-rep... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97070 Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Coz... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93322 A malicious frontend can submit an LLB definition that causes buildkitd
to panic... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93323 The Dockerfile frontend loaded the Dockerfile and .dockerignore files of a build... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93318 A malicious image can advertise DiffIDs from another image while containing diff... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93319 A malicious external BuildKit frontend can send requests using the internal API... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93316 If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic wh... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.