October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91844 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Ser... |
high | 7.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16161 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16163 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.6 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16164 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16165 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-16167 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-15781 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.0 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15784 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15819 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15822 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15824 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16111 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16159 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.6 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-107615 An uncontrolled search path element vulnerability in GlavSoft TightVNC Server fo... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107611 An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Vie... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107612 Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62142 Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allow... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66479 Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComp... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44031 Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16178 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16179 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16181 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.4 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-106611 Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminato... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16169 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16170 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16176 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-105076 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-19083 Authorization bypass through User-Controlled key vulnerability in AKIN Software... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107584 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107573 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107574 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMail... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107576 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verific... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107577 Inefficient algorithmic complexity and a non-terminating loop in the MIME proces... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107579 Inefficient algorithmic complexity in the bounce and complaint processing of Pro... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104659 Missing Host header validation and missing throttling of failed administrator si... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104660 Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104704 Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbo... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103649 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104658 The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMa... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103010 Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEn... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.