October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71887 In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a dat... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71888 In Bouncy Castle for Java before 1.86, the streaming CMS AuthenticatedData parse... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71889 In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - or... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71890 In Bouncy Castle for Java before 1.86, validation of an MLS (RFC 9420) external... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71891 In Bouncy Castle for Java before 1.86, BLS12_381BasicScheme.keyValidate, and so... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS key... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-18040 In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through tw... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71883 In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71885 In Bouncy Castle for Java before 1.86, the Messaging Layer Security (MLS, RFC 94... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-71886 In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API ac... |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105090 Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-79113 OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. |
not reported | — | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105050 PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS comman... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104886 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104887 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-75937 A specially crafted HTTP POST request to the web administration interface allows... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104055 The postgresql-operator charm runs a Prometheus postgres_exporter to collect dat... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104873 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104871 The Angular SSR is a server-rise rendering tool for Angular applications. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-64818 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-02 | 2026-10-16 |
| CVE-2026-104855 Wasmtime is a runtime for WebAssembly. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104859 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-05 |
| CVE-2026-102626 An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104854 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104848 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104849 Tinypool is a minimal Node.js worker thread pool implementation. |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104853 Nx is a monorepo solution for TypeScript and polyglot codebases. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104912 MISP contains an authorization flaw in its correlation handling during attribute... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104914 MISP contains an improper access control vulnerability in its attribute search a... |
not reported | — | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-104906 MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object vie... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104907 MISP contains a cross-site scripting (XSS) vulnerability in the remote event pre... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104908 MISP contains an improper input validation vulnerability in the decaying model i... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104910 MISP contains an authorization bypass in the related events listing functionalit... |
not reported | — | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-104847 ProseMirror's view component renders and manages the editable browser interface... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104900 MISP contains a stored cross-site scripting (XSS) vulnerability in the index tab... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104901 MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator fe... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104843 uv is a Python package and project manager written in Rust. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104721 Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-cla... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96277 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96286 Uncaught exception vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.