October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79844 Authentication bypass vulnerabilities in the affected interface of AOS-10 could... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79847 Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead t... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79848 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79849 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79850 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79851 Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that c... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79852 A vulnerability in the web-based management interface of AOS could allow an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79854 A vulnerability in the affected interface of AOS-10 could allow an unauthenticat... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79855 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79856 A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79857 There is a command injection vulnerability in the PAPI protocol (Aruba's access... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
critical | 9.1 | Listed | Palo Alto Networks / PAN-OS | 2026-05-13 | 2026-10-26 |
| CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | Daemon / Daemon Tools Lite | 2026-05-15 | 2026-10-26 |
| CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
critical | 10.0 | Listed | Cisco / Catalyst SD-WAN | 2026-05-14 | 2026-10-26 |
| CVE-2026-44015 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.9 | — | Nginxui / nginx ui | 2026-05-12 | 2026-10-26 |
| CVE-2026-0258 A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o... |
critical | 9.1 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-46470 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
critical | 9.1 | — | Freedesktop / gst-plugins-good | 2026-05-14 | 2026-10-26 |
| CVE-2026-41315 mdserver-web is a simple Linux panel. |
critical | 9.8 | — | Midoks / mdserver-web | 2026-05-14 | 2026-10-26 |
| CVE-2026-26191 Fleet is open source device management software. |
critical | 9.8 | — | Fleetdm / fleet | 2026-05-14 | 2026-10-26 |
| CVE-2026-41553 PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to... |
critical | 10.0 | — | Dhtmlx / pdf export module | 2026-05-15 | 2026-10-26 |
| CVE-2026-45772 Turborepo is a high-performance build system for JavaScript and TypeScript codeb... |
critical | 9.8 | — | Vercel / turborepo | 2026-05-15 | 2026-10-26 |
| CVE-2026-115214 The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify tha... |
critical | 9.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-110956 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114196 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-94075 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability |
critical | 9.9 | Listed | Arista / VeloCloud Orchestrator | 2026-10-22 | 2026-10-26 |
| CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability |
critical | 9.1 | Listed | Adobe / Commerce and Magento | 2026-08-11 | 2026-10-26 |
| CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulner... |
critical | 9.8 | Listed | Citrix / NetScaler | 2026-08-19 | 2026-10-26 |
| CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability |
critical | 9.3 | Listed | MLflow / MLflow | 2026-08-17 | 2026-10-26 |
| CVE-2026-12293 Use-after-free in the Graphics: WebGPU component. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-16 | 2026-10-26 |
| CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elev... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration S... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, the... |
critical | 9.8 | — | Defenseunicorns / uds identity config | 2026-06-05 | 2026-10-26 |
| CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file... |
critical | 9.8 | — | Altium / on-prem enterprise server | 2026-06-05 | 2026-10-26 |
| CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. |
critical | 9.8 | — | Mariadb / mariadb | 2026-06-11 | 2026-10-26 |
| CVE-2026-45177 Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access co... |
critical | 9.1 | — | Paloaltonetworks / idira secrets manager edge | 2026-06-11 | 2026-10-26 |
| CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud... |
critical | 9.1 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50628 A logic error in OAuthRequestFilter rejects legitimate requests originating from... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.