October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-15340 lwIP SMTP client does not check the size of inputs, potentially allowing a buffe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-108109 PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108107 PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105278 The published Docker image for openPDC includes a fixed administrative credentia... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-s... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-86405 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-85531 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-96809 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96331 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96328 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96330 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94503 Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify... |
critical | 10.0 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-93947 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107935 A path traversal vulnerability was found in gvproxy, the network forwarder provi... |
critical | 9.3 | — | — | 2026-10-09 | 2026-11-04 |
| CVE-2026-76779 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-107909 A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) a... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107908 A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-7826 A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-5759 A double free and use-after-free vulnerability in the RdbLoadDeletedNodes functi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-94510 Authorization bypass through user-controlled key in Microsoft Bookings allows an... |
critical | 9.9 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-96207 Improper certificate validation in Microsoft Partner Center allows an unauthoriz... |
critical | 10.0 | — | Microsoft / partner center | 2026-10-08 | 2026-10-15 |
| CVE-2026-88131 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized... |
critical | 9.8 | — | Microsoft / dataverse | 2026-10-08 | 2026-10-15 |
| CVE-2026-77900 Missing authentication for critical function in Azure App Service allows an unau... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same da... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointin... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-84249 IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84035 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84057 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84058 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer over... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84198 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84209 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84246 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-75875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-80381 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-81932 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.