October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104383 Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquil... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104384 Insufficiently Protected Credentials in tunnel gateway and provisioning interfac... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102790 Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations exp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102812 A hard-coded
cryptographic key vulnerability exists in the user-configuration ba... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102816 An authorization vulnerability exists in the country or region configuration int... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-64394 A vulnerability allowing a low-privileged local user to write arbitrary files wi... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106076 A vulnerability allowing an authenticated organization-transfer peer to inject S... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106077 A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administ... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106078 A vulnerability allowing an unauthenticated attacker to bypass REST API authenti... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to byp... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108140 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108141 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-14571 A Blind SQL Injection vulnerability in Futurum Software’s management software, c... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112197 Vulnerability due to a lack of authentication in critical functions of the NoviG... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112198 XML External Entity (XXE) injection vulnerability in the SAFT import feature of... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118174 When a message containing an OpenPGP key attachment was displayed, Thunderbird a... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunder... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118177 When looking for calendars in a directory on a server, during account setup or w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118178 A remote RSS feed could use the itunes:new-feed-url or newLocation element to pe... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118179 Clicking a news: or snews: link that referenced a message-ID made Thunderbird co... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118180 When logging in to a Matrix account, Thunderbird used the homeserver address pro... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103594 A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configura... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-111107 A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112709 A heap-based buffer overflow vulnerability in the Fireware OS authentication ser... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112710 A heap-based buffer overflow vulnerability exists in the Fireware OS authenticat... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113881 A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115495 Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82332 An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint m... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-90442 A stack-based buffer overflow vulnerability in the Fireware OS certd process all... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-90464 An external control of file path vulnerability in a WatchGuard Fireware OS firew... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-93866 An integer overflow vulnerability in the WebSocket connection handling used by W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57197 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57198 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.