October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94415 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94568 Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94632 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78339 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78341 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.2 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-94158 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94159 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94161 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78023 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78024 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78025 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.5 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78026 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78018 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78019 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78020 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78022 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-76769 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-98378 In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip u... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98381 In the Linux kernel, the following vulnerability has been resolved:
veth: manag... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98382 In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98383 In the Linux kernel, the following vulnerability has been resolved:
bpf: Disall... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-19575 The user-mode verification handler for the device_deinit() system call, z_vrfy_d... |
high | 7.8 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-98376 In the Linux kernel, the following vulnerability has been resolved:
bpf: Use ar... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-106145 In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect pri... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106155 In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cros... |
high | 8.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-19569 dynamic_object_create() in kernel/userspace/userspace.c computed the backing all... |
high | 8.8 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-19570 The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copie... |
high | 8.8 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-19574 The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory do... |
high | 7.0 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-93548 The FooSales WordPress plugin before 1.43.3 does not verify that an authenticate... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-97076 Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocke... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-81929 The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulner... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2025-15700 The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-107910 An improper authentication vulnerability in the is_authenticated function (src/b... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107911 A type confusion vulnerability in the _read_flags function (src/commands/cmd_dis... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently prot... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-7827 A stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph de... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previo... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-97032 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK en... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-94444 Previously, a user operating inside of a malicious Go project that defines a bog... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-94447 Previously, a user operating inside of a malicious Go project that defines a bog... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.