October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-55394 Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55395 Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions throu... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-55396 Cleartext transmission without a cryptographic integrity check in operator contr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-94634 Allocation of resources without limits or throttling, Initialization of a resour... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-91137 Improper validation of specified quantity in input, Allocation of resources with... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93925 Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-93926 Missing release of memory after effective lifetime, Missing release of resource... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94633 Memory allocation with excessive size value, Improper handling of length paramet... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-90440 Uncaught exception, improper handling of exceptional conditions, improper resour... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-92834 Use of uninitialized resource, Return of wrong status code vulnerability in Apac... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94646 Uncaught exception, Improper validation of specified quantity in input, Improper... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96277 Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in... |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96286 Uncaught exception vulnerability in Apache Thrift Perl bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96289 Uncontrolled Recursion vulnerability in Apache Thrift PHP bindings. |
not reported | — | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-51936 Zetetic SQLCipher before 4.15.0 allows SQL injection. |
not reported | — | — | — | 2026-09-30 | 2026-10-02 |
| CVE-2026-102937 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-102757 An unprivileged, memory-protected ThreadX module can have the kernel read and wr... |
not reported | — | — | — | 2026-09-29 | 2026-10-02 |
| CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-13313 An Active Debug Code vulnerability in certain ASUS router models allows a remote... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102294 TP-Link TL-WR841N contains an authenticated OS command injection vulnerability i... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82371 Plaintext exposure of sensitive authentication data in Brocade SANnav discovery... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modificatio... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82368 Insecure access controls on internal service ports in Brocade SANnav versions be... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-82369 Insufficient input sanitization of shell metacharacters in the Brocade SANnav CL... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-14441 A logic flaw in Java cache key handling object comparison handling could lead to... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14442 An information exposure vulnerability in the job scheduling component of SANnav... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14443 Incomplete log sanitization during bulk IPsec policy collection in Brocade SANna... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-101322 In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102369 Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanit... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78577 Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan fu... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78578 Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboa... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/b... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71426 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71542 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7174 CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocan... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7175 CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of th... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/cust... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-75786 Unsanitized concatenation of the module parameter in the Grafana datasource endp... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7173 CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.