October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93317 An unauthenticated attacker controlling a registry or OCI-layout blob source cou... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105632 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104976 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-86671 In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104966 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104968 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-104892 Plane is an open-source project management tool. |
not reported | — | — | — | 2026-10-05 | 2026-10-05 |
| CVE-2026-63270 URLs could be constructed which expanded environment variable or INI file values... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63277 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63266 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63267 LibreOffice Calc can link a cell range to an external csv data source, and the l... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63268 LibreOffice Calc can link a cell range to an external data source, and the link... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-63269 LibreOffice can link to audio and video files from a document, and on Linux it p... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59788 The email media type OAuth form passes the Authorization endpoint value to windo... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59782 The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerabili... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59783 The Zabbix Server/Proxy has a vulnerability where binary items can crash the Ser... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59785 Host search in Frontend allows filtering by fields that are not displayed, inclu... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59786 Zabbix Server and Proxy accept the active agent heartbeat message regardless of... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-59787 The Perl SNMP trap receiver script shipped with Zabbix does not properly neutral... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-19395 In Qt for MCUs, a Text element that displays styled text halts the device if an... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104809 DigitalCanion has discovered a vulnerability that allows an attacker to cause th... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104810 This vulnerability allows remote attackers to delete sensitive files on vulnerab... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104811 DigitalCanion SA has discovered a vulnerability that allows remote attackers to... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104706 DigitalCanion has discovered a path traversal vulnerability that allows to view... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104805 DigitalCanion has discovered a vulnerability in the backup restoration functiona... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104806 DigitalCanion has discovered a path traversal vulnerability that allows an attac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104807 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104808 DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability t... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103511 Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to it... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103512 Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when valid... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103335 Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajrac... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103507 Perforce P4 Search prior to 2026.4.2 does not restrict file paths written throug... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-103510 P4 Search prior to 2026.4.2 does not fail securely when its service authenticati... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100102 Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-100103 Perforce P4 Search container images prior to 2026.4.2 reset the service authenti... |
not reported | — | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105301 Rejected reason: This candidate was rejected after further investigation determi... |
not reported | — | — | — | 2026-10-05 | 2026-10-21 |
| CVE-2026-105214 Zitadel before 4.16.2 contains a server-side request forgery vulnerability that... |
not reported | — | — | — | 2026-10-04 | 2026-10-05 |
| CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authori... |
not reported | — | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-85515 In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97873 In Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.