October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76407 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-11-02 |
| CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-76527 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-76528 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-11-02 |
| CVE-2026-76529 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-24 |
| CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote r... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-114383 A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114382 A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-96639 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-21 | 2026-10-29 |
| CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111814 Apache Traffic Server's default outbound session-sharing policy can reuse a pool... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111809 Apache Traffic Server allows request smuggling via HEAD requests that carry Cont... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated ne... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-114268 A flaw has been found in Tenda BE3L Pro 16.03.60.62. |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated clien... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111816 Apache Traffic Server forwarded a malformed 302 response that should have been r... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76474 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76475 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76466 A vulnerability in the database service feature of Cisco Expressway Series could... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76473 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-20043 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111852 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111832 Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111834 Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109618 PHP Memory Corruption Vulnerability |
critical | 9.8 | Listed | PHP Group / PHP | 2026-10-21 | 2026-11-04 |
| CVE-2026-86249 On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_p... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78334 Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-59562 Missing authentication for critical function vulnerability in Apache IoTDB. |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56388 The Redis server command parser in Apache bRPC accepts an empty RESP array as a... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-48830 Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenti... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-87095 Sensitive information disclosure and manipulation due to improper authorization... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-58663 An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC servi... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shar... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.