October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,949
Critical
3,231
High
7,652
Medium
7,322
Low
724
Severity not reported
5,020
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1400), google (802), linux (663), ibm (323), mozilla (182), oracle (157), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76578 A flaw was found in FreeIPA. |
critical | 9.8 | — | — | 2026-09-07 | 2026-10-26 |
| CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability |
critical | 9.1 | Listed | Palo Alto Networks / PAN-OS | 2026-05-13 | 2026-10-26 |
| CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | Daemon / Daemon Tools Lite | 2026-05-15 | 2026-10-26 |
| CVE-2026-20182 Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
critical | 10.0 | Listed | Cisco / Catalyst SD-WAN | 2026-05-14 | 2026-10-26 |
| CVE-2026-44015 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.9 | — | Nginxui / nginx ui | 2026-05-12 | 2026-10-26 |
| CVE-2026-0258 A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o... |
critical | 9.1 | — | Paloaltonetworks / pan-os | 2026-05-13 | 2026-10-26 |
| CVE-2026-46470 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
critical | 9.1 | — | Freedesktop / gst-plugins-good | 2026-05-14 | 2026-10-26 |
| CVE-2026-41315 mdserver-web is a simple Linux panel. |
critical | 9.8 | — | Midoks / mdserver-web | 2026-05-14 | 2026-10-26 |
| CVE-2026-26191 Fleet is open source device management software. |
critical | 9.8 | — | Fleetdm / fleet | 2026-05-14 | 2026-10-26 |
| CVE-2026-41553 PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to... |
critical | 10.0 | — | Dhtmlx / pdf export module | 2026-05-15 | 2026-10-26 |
| CVE-2026-45772 Turborepo is a high-performance build system for JavaScript and TypeScript codeb... |
critical | 9.8 | — | Vercel / turborepo | 2026-05-15 | 2026-10-26 |
| CVE-2026-115214 The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify tha... |
critical | 9.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-110956 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111402 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112866 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114196 Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytiu... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-94075 Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletter... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116231 A security flaw has been discovered in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116233 A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116234 A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability |
critical | 9.9 | Listed | Arista / VeloCloud Orchestrator | 2026-10-22 | 2026-10-26 |
| CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability |
critical | 9.1 | Listed | Adobe / Commerce and Magento | 2026-08-11 | 2026-10-26 |
| CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulner... |
critical | 9.8 | Listed | Citrix / NetScaler | 2026-08-19 | 2026-10-26 |
| CVE-2026-64849 MLflow Server-Side Request Forgery Vulnerability |
critical | 9.3 | Listed | MLflow / MLflow | 2026-08-17 | 2026-10-26 |
| CVE-2026-12293 Use-after-free in the Graphics: WebGPU component. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-16 | 2026-10-26 |
| CVE-2026-97785 Improper authentication in AAD App Proxy allows an unauthorized attacker to elev... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-83938 Missing authentication for critical function in Azure Kubernetes Configuration S... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-4408 A flaw was found in Samba. |
critical | 9.8 | — | Redhat / openshift container platform | 2026-05-28 | 2026-10-26 |
| CVE-2026-46389 UDS Identity Config builds the Keycloak configuration image (realm, plugins, the... |
critical | 9.8 | — | Defenseunicorns / uds identity config | 2026-06-05 | 2026-10-26 |
| CVE-2026-11414 A hard-coded cryptographic key is used by Altium Enterprise Server to sign file... |
critical | 9.8 | — | Altium / on-prem enterprise server | 2026-06-05 | 2026-10-26 |
| CVE-2026-49261 MariaDB server is a community developed fork of MySQL server. |
critical | 9.8 | — | Mariadb / mariadb | 2026-06-11 | 2026-10-26 |
| CVE-2026-45177 Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access co... |
critical | 9.1 | — | Paloaltonetworks / idira secrets manager edge | 2026-06-11 | 2026-10-26 |
| CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud... |
critical | 9.1 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50628 A logic error in OAuthRequestFilter rejects legitimate requests originating from... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50083 The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client c... |
critical | 9.8 | — | Aqara / iam\/sso gateway | 2026-06-12 | 2026-10-26 |
| CVE-2026-50085 The Aqara Board service (op-test.aqara.com) accepts arbitrary MQTT command paylo... |
critical | 9.8 | — | Aqara / board service | 2026-06-12 | 2026-10-26 |
| CVE-2026-50086 The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round... |
critical | 9.8 | — | Aqara / iam\/sso gateway | 2026-06-12 | 2026-10-26 |
| CVE-2026-44170 MariaDB server is a community developed fork of MySQL server. |
critical | 9.8 | — | Mariadb / mariadb | 2026-06-12 | 2026-10-26 |
| CVE-2026-44172 MariaDB server is a community developed fork of MySQL server. |
critical | 9.1 | — | Mariadb / mariadb | 2026-06-12 | 2026-10-26 |
| CVE-2026-32967 Incorrect Authorization vulnerability of `/v2` experimental interface in Apache... |
critical | 9.1 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.