October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95707 A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an aut... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95708 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95709 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operat... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95711 An authentication bypass vulnerability in the web-based management interface of... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79895 Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticat... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79955 An unauthenticated memory corruption vulnerability exists in a service accessed... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79956 A vulnerability in the CLI command handling of the AOS-8 web interface could all... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79885 An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8... |
high | 8.2 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79886 An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of... |
high | 8.2 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79887 A vulnerability in the web interface of AOS-8 could allow an unauthenticated rem... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79888 A vulnerability in a certain web interface endpoint of AOS-8 devices could allow... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79889 Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79890 There are command injection vulnerabilities in AOS-8 that could lead to unauthen... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79891 A buffer overflow vulnerability exists in the command line interface of AOS-8 th... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79892 A memory corruption vulnerability exists in AOS-8 that could allow an authentica... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79893 Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remot... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79894 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI prot... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79877 A remote code execution vulnerability in the underlying operating system of AOS-... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79878 A command injection vulnerability in the AOS-8 command line interface accessed b... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79879 Memory corruption vulnerabilities in the affected interface of AOS-10 could lead... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79880 A vulnerability in the command line interface of AOS-8 could allow an authentica... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79881 An authentication bypass vulnerability in the underlying operating system of AOS... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79882 There is a command injection vulnerability in the PAPI protocol of AOS-10 that c... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 co... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79884 A vulnerability in the web-based management interface of AOS-8 could allow an un... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might a... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115392 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0... |
high | 7.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115371 Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115374 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verificatio... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115352 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115353 Mistune before 3.3.0 contains a path traversal vulnerability in the RST include... |
high | 8.6 | — | — | 2026-10-22 | 2026-11-04 |
| CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include dire... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115347 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerabilit... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115348 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115349 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of ser... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114648 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionar... |
high | 7.6 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-114613 MessagePack is the serializer implementation for Python msgpack.org. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.