October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,412
High
6,177
Medium
6,472
Low
662
Severity not reported
2,758
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (422), apple (336), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12260 SQL injection in the NetBoard CRM demo platform; specifically, the vulnerable co... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-4894 A vulnerability has been identified regarding insufficient validation in the Fra... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93699 Argument injection in WP Toolkit for cPanel allows local users to execute arbitr... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-102488 In affected versions, Octopus Server incorrectly evaluates multiple scoped permi... |
not reported | — | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-97664 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-07 | 2026-10-16 |
| CVE-2026-107282 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107231 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-107279 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107280 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107281 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the proj... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97715 CVE-2026-97715 is
a vulnerability in the client registration process of Secure A... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97716 CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97717 CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access serve... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97714 CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secur... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107354 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107355 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allo... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92542 The firewall rules which mark VXLAN datagrams for encryption indiscriminately ma... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92543 Docker Engine classifies a registry hostname as insecure using an any-match DNS... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107276 MISP contains a race condition in the email-based one-time password (OTP) login... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107278 MISP contains a validation flaw in its object synchronization logic. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-33586 Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107194 Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account t... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required),... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-98373 In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb:... |
not reported | — | — | — | 2026-10-07 | 2026-10-30 |
| CVE-2026-107175 MISP contains a defect in its event save workflow that prevents the correlation... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103435 Claude Code validated that a target file path resided within the project working... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92531 Operating system command injection vulnerability in the SVN integration componen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92532 Unrestricted file upload vulnerability in the BugTracker.NET attachment function... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97146 Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annota... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92393 Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation c... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-78243 Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, cra... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93026 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modif... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107104 This vulnerability exists in the ERP system due to unsafe deserialization of use... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud C... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-5703 Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, sp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64392 This vulnerability in Veeam Backup Enterprise Manager allows an attacker to exec... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.