October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79865 A memory corruption vulnerability in the affected interface of AOS-10 could allo... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79866 An unauthenticated path traversal vulnerability exists in the PAPI protocol in A... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79849 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79850 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79851 Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that c... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79852 A vulnerability in the web-based management interface of AOS could allow an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79853 Sensitive information disclosure vulnerabilities in the affected interface of AO... |
critical | 9.8 | — | — | 2026-10-22 | 2026-11-02 |
| CVE-2026-79854 A vulnerability in the affected interface of AOS-10 could allow an unauthenticat... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79855 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79856 A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79857 There is a command injection vulnerability in the PAPI protocol (Aruba's access... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79844 Authentication bypass vulnerabilities in the affected interface of AOS-10 could... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79846 Command injection vulnerabilities exist in the affected interface of AOS-8 that... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79847 Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead t... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79848 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer o... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulner... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2025-65200 An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability tha... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114611 OCO-Server is a self-hosted endpoint management application for computer invento... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114607 Better Auth is an authentication and authorization library for TypeScript. |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-78846 Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP l... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-85080 In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can resul... |
critical | 9.1 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-94502 In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can res... |
critical | 9.8 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-85079 In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result... |
critical | 9.8 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google... |
critical | 9.8 | Listed | Google / brotli | 2026-10-22 | 2026-11-04 |
| CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2022-51022 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated... |
critical | 9.1 | — | — | 2026-10-22 | 2026-11-03 |
| CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMs... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112241 Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart sur... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114220 NT OneAPP developed by NewType Infortech has an Improper Certificate Validation... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114656 Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerabilit... |
critical | 9.3 | — | Traefik / traefik | 2026-10-22 | 2026-11-04 |
| CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef... |
critical | 10.0 | — | Gitlab / gitlab | 2026-10-22 | 2026-11-04 |
| CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.