October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,674
Critical
3,172
High
7,258
Medium
7,101
Low
645
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58392 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58393 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58394 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 5.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58395 OPNsense is a FreeBSD based firewall and routing platform. |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-14308 Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affe... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-67626 Uncontrolled resource consumption in SQL Server allows an authorized attacker to... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-67628 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-94520 Use of externally-controlled format string in SQL Server allows an authorized at... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-107153 Multiple smartphones provided by Rakuten Mobile, Inc. |
medium | 6.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103671 External control of assumed-Immutable web parameter issue exists in EC-CUBE plug... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105271 "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storag... |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-72528 "Handmade Marketplace App - Creema" provided by CREEMA LTD. |
medium | 4.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-75559 The smartphone application "Vehicle Inspection Certificate Viewer" contains a vu... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-96614 "ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-48211 An authenticated administrator can be induced to delete administrative Import/Ex... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-48212 An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS... |
medium | 4.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-78356 The OTRS Agent Frontend configuration endpoint can be accessed without authentic... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-78358 Several administrative actions do not sufficiently validate whether a request wa... |
medium | 4.3 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-78359 OTRS does not sufficiently enforce the uniqueness of customer user identities ac... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-93581 User-controlled values are not sufficiently neutralized when included in CSV exp... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-76972 Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integrati... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-76975 Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-76976 Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89105 The HybridTokenAuthenticator component of the SAP/cloud-security-services-integr... |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89106 SAP UI5 does not perform sufficient input validation under certain configuration... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89112 The admin API endpoint used to retrieve CLA signature records does not consisten... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89116 The affected code used child_process.execSync with a shell string for generator... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89117 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject mal... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89118 SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access res... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89121 SAP S/4HANA does not perform sufficient instance-level authorization checks for... |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89122 SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certai... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89124 Display Product Catalog Based on Customs Declaration application does not perfor... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-44414 A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Indu... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63351 Affected devices do not properly validate and sanitize visual properties of calc... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63352 Affected devices do not properly sanitize calculated signal data contained in im... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63355 Affected devices do not properly sanitize signal names contained in imported CSV... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63356 Affected devices do not properly sanitize calculated signal names contained in i... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63357 Affected devices do not properly sanitize calculated signal data contained in im... |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89200 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89203 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.