October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104024 Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confir... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-88794 Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104025 Path Traversal (CWE-22) in the execute_obj function of the archive object viewer... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-50612 An unix symbolic link (symlink) following vulnerability has been reported to aff... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-50619 A path traversal vulnerability has been reported to affect Qsirch. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-53882 An improper link resolution before file access ('link following') vulnerability... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39991 A cross-site scripting (XSS) vulnerability has been reported to affect Notes Sta... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39997 A missing authentication for critical function vulnerability has been reported t... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-41541 An unix symbolic link (symlink) following vulnerability has been reported to aff... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-41545 A relative path traversal vulnerability has been reported to affect QuMagie. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-47786 An OS command injection vulnerability has been reported to affect HybridDesk Sta... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-47790 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Ser... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34006 A missing authentication for critical function vulnerability has been reported t... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34007 An OS command injection vulnerability has been reported to affect Notes Station... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34008 An incorrect permission assignment for critical resource vulnerability has been... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34009 An improper isolation or compartmentalization vulnerability has been reported to... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34014 An incorrect permission assignment for critical resource vulnerability has been... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39989 A server-side request forgery (SSRF) vulnerability has been reported to affect D... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18660 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`,... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18662 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19863 An unauthenticated client may access certain protected resources when using Ethe... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19864 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-26243 A path traversal vulnerability has been reported to affect Qsync Central. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18659 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to fo... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/.... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, th... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-16438 Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 ve... |
not reported | — | — | — | 2026-10-15 | 2026-11-05 |
| CVE-2026-18661 In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-35088 Slican telephone exchanges use symmetric encryption for TCP/IP communication. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-63314 WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-63315 WebCTI service for Slican IPx telephone exchanges stores temporary subscriber pa... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-16436 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubi... |
not reported | — | — | — | 2026-10-15 | 2026-11-05 |
| CVE-2026-16437 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubi... |
not reported | — | — | — | 2026-10-15 | 2026-11-05 |
| CVE-2026-101287 Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to t... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39993 A relative path traversal vulnerability has been reported to affect Download Sta... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-41544 A path traversal vulnerability has been reported to affect QcalAgent. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19377 Improper certificate validation in the tunnel handshake in Cato Client allows a... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-22896 A cross-site scripting (XSS) vulnerability has been reported to affect Network &... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-24715 An observable timing discrepancy vulnerability has been reported to affect QuRou... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.