October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-64618 Improper Neutralization of Special Elements used in an SQL Command ("SQL Injecti... |
critical | 9.8 | — | Apache / fineract | 2026-10-30 | 2026-11-02 |
| CVE-2026-79983 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.1 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-79986 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
critical | 9.1 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-78162 Deserialization of Untrusted Data vulnerability in Apache Camel. |
critical | 9.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabb... |
critical | 9.1 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-104711 Improper neutralization of special elements used in an expression language state... |
critical | 9.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-59797 Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-57941 Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared sessio... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-56154 Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using look... |
critical | 9.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-65874 This issue affects Apache Fineract versions up to and including 1.15.0. |
high | 8.8 | — | Apache / fineract | 2026-10-30 | 2026-11-02 |
| CVE-2026-88900 Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups co... |
high | 8.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85250 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85251 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-80343 Improper Handling of Case Sensitivity vulnerability in Apache Camel Netty HTTP c... |
high | 8.2 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-80344 Server-Side Request Forgery (SSRF) vulnerability in Apache Camel AS2 component. |
high | 8.2 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operat... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not ful... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the tot... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth... |
high | 8.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's J... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-104712 Asymmetric resource consumption (amplification) vulnerability in Apache Struts. |
high | 7.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-104714 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-93546 Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an au... |
high | 8.8 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-73637 Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Serv... |
high | 7.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63718 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-73636 Authentication bypass by capture-replay in mod_auth_digest in Apache Software Fo... |
high | 8.1 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-59685 Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while process... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63045 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Softwar... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63292 Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apa... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63686 A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache H... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-56153 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-02 |
| CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with cr... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-21 |
| CVE-2026-48005 Missing authentication checks in mod_auth_digest in Apache Software Foundation A... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-46729 NULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor o... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-08 |
| CVE-2026-47360 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.