October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,209
Critical
3,102
High
7,090
Medium
6,615
Low
674
Severity not reported
4,728
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79872 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
critical | 9.4 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79873 Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79874 An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79875 A vulnerability has been identified in the PAPI protocol of AOS-8 that could pot... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79876 A sensitive information disclosure vulnerability in the Wi-Fi frame processing o... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-76578 A flaw was found in FreeIPA. |
critical | 9.8 | — | — | 2026-09-07 | 2026-10-26 |
| CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
critical | 9.1 | Listed | Palo Alto Networks / PAN-OS | 2026-05-13 | 2026-10-26 |
| CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | Daemon / Daemon Tools Lite | 2026-05-15 | 2026-10-26 |
| CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
critical | 10.0 | Listed | Cisco / Catalyst SD-WAN | 2026-05-14 | 2026-10-26 |
| CVE-2026-44015 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.9 | — | Nginxui / nginx ui | 2026-05-12 | 2026-10-26 |
| CVE-2026-0258 A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o... |
critical | 9.1 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-46470 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
critical | 9.1 | — | Freedesktop / gst-plugins-good | 2026-05-14 | 2026-10-26 |
| CVE-2026-41315 mdserver-web is a simple Linux panel. |
critical | 9.8 | — | Midoks / mdserver-web | 2026-05-14 | 2026-10-26 |
| CVE-2026-26191 Fleet is open source device management software. |
critical | 9.8 | — | Fleetdm / fleet | 2026-05-14 | 2026-10-26 |
| CVE-2026-41553 PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to... |
critical | 10.0 | — | Dhtmlx / pdf export module | 2026-05-15 | 2026-10-26 |
| CVE-2026-45772 Turborepo is a high-performance build system for JavaScript and TypeScript codeb... |
critical | 9.8 | — | Vercel / turborepo | 2026-05-15 | 2026-10-26 |
| CVE-2026-115214 The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify tha... |
critical | 9.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-110956 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114196 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-94075 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115995 A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to... |
critical | 9.6 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116231 A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116233 A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116234 A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability |
critical | 9.9 | Listed | Arista / VeloCloud Orchestrator | 2026-10-22 | 2026-10-26 |
| CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability |
critical | 9.1 | Listed | Adobe / Commerce and Magento | 2026-08-11 | 2026-10-26 |
| CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulner... |
critical | 9.8 | Listed | Citrix / NetScaler | 2026-08-19 | 2026-10-26 |
| CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability |
critical | 9.3 | Listed | MLflow / MLflow | 2026-08-17 | 2026-10-26 |
| CVE-2026-12293 Use-after-free in the Graphics: WebGPU component. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-16 | 2026-10-26 |
| CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elev... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration S... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-4408 A flaw was found in Samba. |
critical | 9.8 | — | Redhat / openshift container platform | 2026-05-28 | 2026-10-26 |
| CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, the... |
critical | 9.8 | — | Defenseunicorns / uds identity config | 2026-06-05 | 2026-10-26 |
| CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file... |
critical | 9.8 | — | Altium / on-prem enterprise server | 2026-06-05 | 2026-10-26 |
| CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. |
critical | 9.8 | — | Mariadb / mariadb | 2026-06-11 | 2026-10-26 |
| CVE-2026-45177 Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access co... |
critical | 9.1 | — | Paloaltonetworks / idira secrets manager edge | 2026-06-11 | 2026-10-26 |
| CVE-2026-49875 Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud... |
critical | 9.1 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.