October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50628 A logic error in OAuthRequestFilter rejects legitimate requests originating from... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50083 The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client c... |
critical | 9.8 | — | Aqara / iam\/sso gateway | 2026-06-12 | 2026-10-26 |
| CVE-2026-50085 The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command paylo... |
critical | 9.8 | — | Aqara / board service | 2026-06-12 | 2026-10-26 |
| CVE-2026-50086 The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round... |
critical | 9.8 | — | Aqara / iam\/sso gateway | 2026-06-12 | 2026-10-26 |
| CVE-2026-44170 MariaDB server is a community developed fork of MySQL server. |
critical | 9.8 | — | Mariadb / mariadb | 2026-06-12 | 2026-10-26 |
| CVE-2026-44172 MariaDB server is a community developed fork of MySQL server. |
critical | 9.1 | — | Mariadb / mariadb | 2026-06-12 | 2026-10-26 |
| CVE-2026-32967 Incorrect Authorization vulnerability of `/v2` experimental interface in Apache... |
critical | 9.1 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-26 |
| CVE-2026-30803 Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core... |
critical | 9.1 | — | Rti / connext micro | 2026-06-17 | 2026-10-26 |
| CVE-2026-11717 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-11718 An authentication bypass vulnerability exists in the generic opaque token valida... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-18 | 2026-10-26 |
| CVE-2026-9158 In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE conne... |
critical | 9.8 | — | Eclipse / 4diac forte | 2026-06-18 | 2026-10-26 |
| CVE-2026-50242 In JetBrains Hub before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.14812... |
critical | 9.8 | — | Jetbrains / hub | 2026-06-19 | 2026-10-26 |
| CVE-2026-44087 Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-49871 Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under def... |
critical | 9.3 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-54309 n8n is an open source workflow automation platform. |
critical | 10.0 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-54310 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44789 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44791 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-44792 n8n is an open source workflow automation platform. |
critical | 9.0 | — | N8n / n8n | 2026-06-23 | 2026-10-26 |
| CVE-2026-55191 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-55194 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-63633 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.8 | — | Freerdp / freerdp | 2026-08-19 | 2026-10-26 |
| CVE-2026-20043 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111813 Apache Traffic Server's experimental magick plugin lets an unauthenticated clien... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111816 Apache Traffic Server forwarded a malformed 302 response that should have been r... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-111811 Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated ne... |
critical | 9.0 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-75595 Netty is an asynchronous, event-driven network application framework. |
critical | 9.1 | — | Netty / netty | 2026-08-19 | 2026-10-26 |
| CVE-2026-19586 A pre-authentication OS command injection vulnerability has been identified in O... |
critical | 9.8 | — | Tp-link / er7212pc firmware | 2026-08-20 | 2026-10-26 |
| CVE-2026-17423 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-17436 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18670 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18716 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated... |
critical | 9.1 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-18832 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-19437 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / vios | 2026-08-20 | 2026-10-26 |
| CVE-2026-28367 A flaw was found in Undertow. |
critical | 9.1 | — | Redhat / build of apache camel - hawtio | 2026-03-27 | 2026-10-26 |
| CVE-2026-33943 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
critical | 9.8 | — | Capricorn86 / happy dom | 2026-03-27 | 2026-10-26 |
| CVE-2026-34568 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-5663 A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. |
critical | 9.8 | — | Offis / dcmtk | 2026-04-06 | 2026-10-26 |
| CVE-2026-5973 A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. |
critical | 9.1 | — | Vikunja / vikunja | 2026-04-10 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.