October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95664 Improper Neutralization of Special Elements used in an Expression Language State... |
medium | 5.4 | — | Apache / camel | 2026-10-26 | 2026-11-02 |
| CVE-2026-85317 Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP... |
medium | 4.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85296 Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 comp... |
medium | 6.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85312 Improper Input Validation vulnerability in Apache Camel Core component. |
medium | 4.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85313 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Ca... |
medium | 4.3 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85314 Improper Input Validation vulnerability in Apache Camel Mail component. |
medium | 6.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85315 Generation of Error Message Containing Sensitive Information vulnerability in Ap... |
medium | 5.3 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85316 Insufficient Granularity of Access Control vulnerability in Apache Camel Platfor... |
medium | 4.8 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85249 Improper Input Validation vulnerability in Apache Camel Tika component. |
medium | 6.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85254 Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTT... |
medium | 6.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85257 Generation of Error Message Containing Sensitive Information vulnerability in Ap... |
medium | 5.3 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85260 Insertion of Sensitive Information into Log File vulnerability in Apache Camel M... |
medium | 5.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-84180 Generation of Error Message Containing Sensitive Information vulnerability in Ap... |
medium | 5.3 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-84181 Improper Authentication vulnerability in Apache Camel Shiro component. |
medium | 5.9 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85243 Improper Validation of Integrity Check Value vulnerability in Apache Camel Crypt... |
medium | 5.9 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85245 Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift c... |
medium | 5.9 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85246 Generation of Error Message Containing Sensitive Information vulnerability in Ap... |
medium | 5.3 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-85247 Improper Certificate Validation vulnerability in Apache Camel Knative component. |
medium | 5.9 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-84176 Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Ca... |
medium | 6.5 | — | Apache / camel | 2026-10-19 | 2026-11-03 |
| CVE-2026-79650 Apache CXF’s OIDC relying-party component could redirect users to an attacker-co... |
medium | 6.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-92415 — Use of Externally-Controlled Input to Select Classes or Code vulnerability in... |
medium | 5.3 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-90466 Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-control... |
medium | 6.5 | — | Apache / impala | 2026-10-07 | 2026-10-13 |
| CVE-2026-105242 Improper Handling of Exceptional Conditions vulnerability in the aspnet-request... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105243 Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105244 Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppende... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105239 Improper Neutralization of Null Byte or NUL Character vulnerability in the Event... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105240 Improper Neutralization of Null Byte or NUL Character vulnerability in the Outpu... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-105241 Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender... |
medium | 5.3 | — | Apache / log4net | 2026-10-06 | 2026-10-09 |
| CVE-2026-104713 Allocation of resources without limits or throttling vulnerability in the Apache... |
medium | 6.5 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-79768 Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Serv... |
medium | 5.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-58415 Internal state files accessible to external parties in mod_dav_fs in Apache Soft... |
medium | 5.3 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-42528 A memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an... |
medium | 4.3 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
| CVE-2026-42356 Deployment of wrong handler vulnerability in Apache HTTP Server allows the targe... |
low | 3.7 | — | Apache / http server | 2026-10-01 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.