October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,200
Critical
3,101
High
7,090
Medium
6,614
Low
672
Severity not reported
4,723
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (125), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17176 An OS
command injection vulnerability in the TDDP module of Deco BE11000 and Dec... |
not reported | — | — | — | 2026-09-11 | 2026-10-01 |
| CVE-2026-78210 In affected versions of Octopus Server, users with certain scoped permission set... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78249 A path traversal vulnerability exists in the web management interface of multipl... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76146 An OS command injection vulnerability in Genian SSL PNS allows an attacker who k... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76147 A path traversal (ZIP Slip) vulnerability caused by insufficient authorization a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76143 A missing authorization vulnerability in Genian SSL PNS allows an attacker to by... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76144 An unrestricted file upload vulnerability caused by insufficient file extension... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76145 An improper privilege management vulnerability in Genian SSL PNS allows an attac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76142 Insufficient authentication and access control on the internal-only IPC SOAP end... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34189 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34190 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-18734 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103664 MISP contains a reflected cross-site scripting (XSS) vulnerability in the analys... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103651 MISP contains a vulnerability in its one-time password (OTP) authentication flow... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103655 MISP contains a vulnerability in its two-factor authentication (TOTP) verificati... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103659 MISP contains an authorization bypass in the event flattening feature. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103662 MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103584 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103585 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-101276 iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-101283 iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rs... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-94220 Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94250 Allocation of resources without limits or throttling vulnerability in batch-requ... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94269 Use of Non-Canonical URL paths for authorization decisions vulnerability in Apac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94276 Improper Authentication vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95137 Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94212 Improper verification of cryptographic signature vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82806 Exposure of data element to wrong session vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78242 Insertion of sensitive information into log file vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64946 A chained CSRF and unrestricted SVG file upload vulnerability in the File Manage... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103858 MISP contains an incomplete authorization check in the discussion posting functi... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101901 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101905 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js. |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101911 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in... |
not reported | — | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-103547 In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated B... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103656 Rejected reason: this is rejected |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103548 Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows atta... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-94684 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-81433 A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fin... |
not reported | — | — | — | 2026-09-30 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.