October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106457 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-cloudflare-access-provider | 2026-10-06 | 2026-10-27 |
| CVE-2026-106459 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-sentry | 2026-10-06 | 2026-10-13 |
| CVE-2026-106455 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-13 |
| CVE-2026-106062 A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader... |
high | 7.8 | — | — | 2026-10-06 | 2026-11-04 |
| CVE-2026-101258 A flaw was found in Ghostscript. |
high | 7.8 | — | — | 2026-10-06 | 2026-11-04 |
| CVE-2026-96399 A repository's external issue tracker regular expression containing alternating... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96404 When Gitea's web installer is reachable against a database that already contains... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96580 Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian pro... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-89430 Gitea validated a push mirror's remote address against the `[migrations]` allow... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79960 When a push was authenticated with a deploy key, Gitea recorded the repository o... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79806 A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Lin... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79807 A missing integrity verification vulnerability in the Windows client software fo... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79808 A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79809 An unauthenticated path traversal vulnerability exists in an API endpoint of Cle... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79810 Remote code execution vulnerabilities exist in the affected interface of HPE Net... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79811 A SQL injection vulnerability in the API of ClearPass Policy Manager could allow... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79797 An improper access control vulnerability exists in the Android client applicatio... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79799 A vulnerability in the web-based management interface of ClearPass Policy Manage... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79800 An authenticated path traversal vulnerability exists in the command line interfa... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79802 A command injection vulnerability exists in the client software of ClearPass Pol... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79803 A command injection vulnerability exists in the API of ClearPass Policy Manager. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76748 A privilege escalation vulnerability exists in the API of AOS-S. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-70357 Gitea validates a repository migration hostname against its network allow and bl... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104626 A user who can open a fork pull request can place workflow content with a shared... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104632 Gitea Actions blocks the jobs of workflow runs from first-time fork pull request... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104636 Gitea validated the initial remote URL for push mirrors, wiki remote checks, and... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can... |
high | 7.1 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103504 Changing an organization team's permission through the API with only the `permis... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level con... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-104048 A flaw was found in SSSD. |
high | 8.1 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-09 |
| CVE-2026-103007 Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalat... |
high | 7.2 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-102406 Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead... |
high | 8.8 | — | Elastic / kibana | 2026-10-06 | 2026-10-13 |
| CVE-2026-102160 An operating system (OS) command injection vulnerability in CloudVision CUE back... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102161 An unauthenticated attacker located on an adjacent private network (or any attac... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102162 On affected Arista Wi-Fi access points with captive portal, or application firew... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102163 On affected Arista access points with Wireless Intrusion Prevention System (WIPS... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102165 On affected Arista Wi-Fi access points, an unauthenticated attacker with network... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102167 On affected Arista Wi-Fi access points, a memory corruption vulnerability exists... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-101158 A missing input validation vulnerability in the Fileserver upload API allows an... |
high | 8.4 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-102155 An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectral... |
high | 8.5 | — | — | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.