October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108906 A vulnerability has been found in Netcore NR268 1.7.121109. |
high | 7.2 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-96940 Weak authentication in Microsoft Exchange Server allows an authorized attacker t... |
high | 8.8 | — | Microsoft / exchange server | 2026-10-02 | 2026-10-15 |
| CVE-2026-101027 When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allo... |
high | 7.7 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-103670 When a Gitea Actions run was inserted, older runs in the same workflow-level con... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-84393 A improper validation of certificate with host mismatch vulnerability in Fortine... |
high | 8.1 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-84854 In the WibuKey driver for Windows below Version 6.72, insufficient validation of... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-33388 An access control vulnerability was discovered in the Credentials Manager functi... |
high | 7.4 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-33389 An improper certificate/host key validation vulnerability was discovered in the... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-15 |
| CVE-2026-14905 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-97287 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-09-30 | 2026-10-15 |
| CVE-2026-78457 Use after free in Windows Security App allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-10-15 |
| CVE-2026-105868 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105849 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105850 Payload is a free and open source headless content management system. |
high | 8.2 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105851 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105852 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105854 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105855 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105856 Payload is a free and open source headless content management system. |
high | 8.3 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105858 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105860 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105861 Payload is a free and open source headless content management system. |
high | 8.2 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105862 Payload is a free and open source headless content management system. |
high | 8.7 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105865 Payload is a free and open source headless content management system. |
high | 8.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105866 Payload is a free and open source headless content management system. |
high | 7.5 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-106100 Payload is a free and open source headless content management system. |
high | 7.1 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-16169 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16170 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16176 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16178 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16179 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16181 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.4 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15781 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.0 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15784 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15819 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15822 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15824 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16111 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16159 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.6 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16161 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.