October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability |
critical | 9.9 | — | Microsoft / azure arc | 2026-09-17 | 2026-10-31 |
| CVE-2026-99153 In the Linux kernel, the following vulnerability has been resolved:
scsi: libis... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-31 |
| CVE-2026-99154 In the Linux kernel, the following vulnerability has been resolved:
scsi: libis... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-31 |
| CVE-2026-78845 Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-31 |
| CVE-2026-116505 A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116508 A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-102649 Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes oper... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116233 A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-48383 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-75732 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-83662 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-89078 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-10-31 |
| CVE-2026-93577 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 9.9 | — | Gitlab / gitlab | 2026-09-24 | 2026-10-31 |
| CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
critical | 9.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-79858 An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AO... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79875 A vulnerability has been identified in the PAPI protocol of AOS-8 that could pot... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79876 A sensitive information disclosure vulnerability in the Wi-Fi frame processing o... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79846 Command injection vulnerabilities exist in the affected interface of AOS-8 that... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114616 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
critical | 9.1 | — | Authlib / authlib | 2026-10-22 | 2026-10-30 |
| CVE-2026-107249 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107058 An issue in Shelter versionCode 445 allows attackers to register their own auth_... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61645 Docat is a tool for hosting versioned static documentation. |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61737 ng-antd-admin is an Angular and NestJS administration system template. |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119597 OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability t... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119660 MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116386 Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 v... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119526 Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows O... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. |
critical | 9.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-90888 Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-79864 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79865 A memory corruption vulnerability in the affected interface of AOS-10 could allo... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79866 An unauthenticated path traversal vulnerability exists in the PAPI protocol in A... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79867 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79868 Authentication bypass vulnerabilities in the affected interface of AOS-8 could a... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79859 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that co... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79860 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that cou... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79861 There is a command injection vulnerability in AOS-10 that could lead to unauthen... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79862 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79863 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.