October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14502 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14508 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14888 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14988 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14269 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerabil... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14990 IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scr... |
critical | 9.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14991 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15762 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16340 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-19218 Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN So... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-92555 Insertion of sensitive information into sent data vulnerability in AKIN Software... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107510 An authenticated high privilege user can inject arguments in troubleshooting com... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105110 OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT d... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-85097 The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107459 The SecuShare Pro developed by Openfind has an OS Command Injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103692 The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any author... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103646 The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentic... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-17609 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-87684 A stack-based buffer overflow vulnerability exists in the SNMP daemon request ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87659 A critical authorization bypass vulnerability exists in the Management Server ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-76284 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-76285 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-76268 In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-95605 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-95606 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Ev... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76501 A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administratio... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76485 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76486 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76498 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76499 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76500 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76471 A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an una... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76480 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76482 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76483 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76464 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76465 A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) fea... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76459 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-76454 A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.