October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,162
Critical
3,186
High
7,387
Medium
6,958
Low
723
Severity not reported
4,908
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1398), google (802), ibm (323), mozilla (182), oracle (157), adobe (151), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to fo... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/.... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, th... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18659 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18660 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`,... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18662 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19863 An unauthenticated client may access certain protected resources when using Ethe... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19864 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110847 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stor... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110852 n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an aut... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110842 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulner... |
not reported | — | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107503 In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer... |
not reported | — | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2026-0309 A command injection vulnerability in Palo Alto Networks PAN-OS® software enables... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-0310 A buffer overflow vulnerability in the XML processing functionality of Palo Alto... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-0308 A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS®... |
not reported | — | — | — | 2026-09-10 | 2026-10-15 |
| CVE-2026-102755 DataEase is an open source data visualization and analysis tool. |
not reported | — | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-21114 Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allow... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21120 Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attac... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21122 Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows l... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21124 Improper input validation in getting cover image in libsimba.heifdec.media.samsu... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21125 Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-21137 Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers... |
not reported | — | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-77096 CVFS contained a missing authentication condition affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-84420 Out-of-bounds read vulnerability in Citirx Citrix Workspace app for Windows. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77090 CVFS contained an XML external entity (XXE) reference handling issue affecting i... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77093 CvFWD contained an integer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77094 CvFWD contained an out-of-bounds write affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77095 CvFWD contained a null pointer dereference affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53564 Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53563 Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This i... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-18228 HyperScale contained a path traversal issue affecting information disclosure. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2025-15679 Under certain circumstances such as reset to factory default operation, the BMC... |
not reported | — | — | — | 2026-09-11 | 2026-10-14 |
| CVE-2026-84994 Qwik is a performance-focused JavaScript framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102514 Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, un... |
not reported | — | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2026-66057 Frappe is a full-stack web application framework. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77099 CVFS contained an input validation issue affecting command execution. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77100 MediaAgent contained a heap-based buffer overflow issue affecting service availa... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97333 QAPI contained a stack-based buffer overflow affecting service availability. |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97334 The network messaging layer contained improper handling of highly compressed dat... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53562 Improper link resolution before file access ('link following') vulnerability in... |
not reported | — | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.