October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,034
Critical
3,238
High
7,713
Medium
7,372
Low
727
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (709), ibm (323), oracle (187), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / azure app service for linux | 2026-07-24 | 2026-10-24 |
| CVE-2026-48144 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-55971 Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. |
critical | 9.8 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58023 Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58662 Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-8470 IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.... |
critical | 9.1 | — | Langflow / langflow | 2026-08-05 | 2026-10-24 |
| CVE-2026-9205 IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in t... |
critical | 9.8 | — | Langflow / langflow | 2026-08-05 | 2026-10-24 |
| CVE-2026-76886 C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows den... |
critical | 9.8 | — | Wireshark / wireshark | 2026-08-19 | 2026-10-24 |
| CVE-2026-105014 Improper neutralization of special elements used in a command ('command injectio... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-24 |
| CVE-2026-101809 Vulnerability in the Workflow product of Oracle E-Business Suite (component: Wor... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-9827 A arbitrary file write vulnerability exists in the boa formUploadFile functional... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9869 A stack-based buffer overflow vulnerability exists in the boa formTR069Config fu... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10138 A OS command injection vulnerability exists in the boa formUpload() functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10139 A stack-based buffer overflow vulnerability exists in the Mcli functionality of... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10141 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10131 An OS command injection vulnerability exists in the boa formPasswordSetup functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10132 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac func... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X20... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10137 A stack-based buffer overflow vulnerability exists in the boa formUpload() funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2023-24482 A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3... |
critical | 9.8 | — | Siemens / comos | 2023-02-14 | 2026-10-23 |
| CVE-2023-30191 PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitem... |
critical | 9.8 | — | Cdesigner Project / cdesigner | 2023-05-17 | 2026-10-23 |
| CVE-2023-2186 On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticat... |
critical | 9.8 | — | Trianglemicroworks / scada data gateway | 2023-06-07 | 2026-10-23 |
| CVE-2023-29542 A newline in a filename could have been used to bypass the file extension securi... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-23 |
| CVE-2026-34977 Aperi'Solve is an open-source steganalysis web platform. |
critical | 9.8 | — | Aperisolve / aperisolve | 2026-04-06 | 2026-10-23 |
| CVE-2026-34989 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35044 BentoML is a Python library for building online serving systems optimized for AI... |
critical | 9.6 | — | Bentoml / bentoml | 2026-04-06 | 2026-10-23 |
| CVE-2026-35047 Brave CMS is an open-source CMS. |
critical | 9.8 | — | Ajax30 / bravecms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35052 D-Tale is the combination of a Flask back-end and a React front-end to view & an... |
critical | 9.8 | — | Man / d-tale | 2026-04-06 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.