October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117616 Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint tha... |
high | 8.8 | — | Jenkins / jenkins | 2026-10-28 | 2026-11-02 |
| CVE-2026-106079 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103410 An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Netw... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Ses... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103407 An Improper Limitation of a Pathname to a Restricted Directory vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103408 A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Ses... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103401 An Improper Link Resolution Before File Access ('Link Following') vulnerability... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Junip... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103403 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-100105 A user with permission to edit contact points but not their protected fields can... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93521 A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server bef... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO pa... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-56828 Shopper is a Headless e-commerce Admin Panel. |
high | 8.8 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-59979 YosemiteCrew provides organization-based service and task management. |
high | 8.3 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-67187 Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-sid... |
high | 7.1 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-116778 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 8.8 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', be... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buff... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Or... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocN... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106971 An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpa... |
high | 7.5 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-106972 Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpac... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-59185 identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kube... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-52729 Xibo is an open source digital signage platform with a web content management sy... |
high | 7.1 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-59164 NORA is a self-hosted artifact registry and pull-through cache. |
high | 7.1 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. |
high | 7.8 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-59177 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
high | 8.8 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-59179 OpenHop is a tool for creating interactive data-flow diagrams. |
high | 8.3 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-116389 Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116390 Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything —... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115590 Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allow... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115603 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Co... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.