October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,384
Critical
3,278
High
7,871
Medium
7,568
Low
735
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82370 Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82371 Plaintext exposure of sensitive authentication data in Brocade SANnav discovery... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modificatio... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-82368 Insecure access controls on internal service ports in Brocade SANnav versions be... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-82369 Insufficient input sanitization of shell metacharacters in the Brocade SANnav CL... |
not reported | — | — | — | 2026-09-23 | 2026-10-01 |
| CVE-2026-14441 A logic flaw in Java cache key handling object comparison handling could lead to... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14442 An information exposure vulnerability in the job scheduling component of SANnav... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-14443 Incomplete log sanitization during bulk IPsec policy collection in Brocade SANna... |
not reported | — | — | — | 2026-09-24 | 2026-10-01 |
| CVE-2026-101322 In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102369 Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanit... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78577 Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan fu... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78578 Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboa... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/b... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71426 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71542 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7174 CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocan... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7175 CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of th... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/cust... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-75786 Unsanitized concatenation of the module parameter in the Grafana datasource endp... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7173 CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64947 A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin F... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64948 Missing authorization in module data retrieval allows unauthorized cross-group a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64949 Incomplete extension blacklist in the File Manager module allows authenticated u... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64950 Missing input validation and output encoding on the directory name parameter in... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-17176 An OS
command injection vulnerability in the TDDP module of Deco BE11000 and Dec... |
not reported | — | — | — | 2026-09-11 | 2026-10-01 |
| CVE-2026-78210 In affected versions of Octopus Server, users with certain scoped permission set... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78249 A path traversal vulnerability exists in the web management interface of multipl... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76146 An OS command injection vulnerability in Genian SSL PNS allows an attacker who k... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76147 A path traversal (ZIP Slip) vulnerability caused by insufficient authorization a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76143 A missing authorization vulnerability in Genian SSL PNS allows an attacker to by... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76144 An unrestricted file upload vulnerability caused by insufficient file extension... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76145 An improper privilege management vulnerability in Genian SSL PNS allows an attac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76142 Insufficient authentication and access control on the internal-only IPC SOAP end... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34189 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34190 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-18734 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103664 MISP contains a reflected cross-site scripting (XSS) vulnerability in the analys... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103651 MISP contains a vulnerability in its one-time password (OTP) authentication flow... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103655 MISP contains a vulnerability in its two-factor authentication (TOTP) verificati... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103659 MISP contains an authorization bypass in the event flattening feature. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.