October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103647 Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 throu... |
high | 8.0 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated u... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated n... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66084 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can i... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade AS... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form dat... |
high | 8.0 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade A... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management serv... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from r... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions b... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various exter... |
high | 8.0 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-103309 The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who c... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interfa... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authenticatio... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of B... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the acc... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-17196 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS... |
high | 7.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnos... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon o... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in th... |
high | 7.1 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management sub... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94578 Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerab... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94582 A memory buffer overflow vulnerability exists in the internal diagnostic and rou... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87671 An out-of-bounds memory read vulnerability exists in the web management daemon o... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87665 A stack-based buffer overflow vulnerability exists in the Internet Key Exchange... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-82627 The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builde... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87682 Multiple OS Command Injection vulnerabilities exist in the management interface... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87683 Multiple stack-based buffer overflow vulnerabilities exist in the REST API manag... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87679 When Brocade Fabric OS versions before 10.0.1 processes trunk configuration oper... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87680 A command injection vulnerability in the REST API management interface of Brocad... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against th... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-107230 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107232 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.