October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,480
Critical
3,285
High
7,908
Medium
7,598
Low
740
Severity not reported
4,949
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103646 The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentic... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103692 The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any author... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14990 IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scr... |
critical | 9.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-67100 HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tena... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-08 |
| CVE-2026-102827 simple-git, an interface for running git commands in any node.js application, en... |
critical | 9.8 | — | Simple-git Project / simple-git | 2026-09-29 | 2026-10-08 |
| CVE-2026-92555 Insertion of sensitive information into sent data vulnerability in AKIN Software... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-19218 Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN So... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-20328 A vulnerability in the web-based management interface of Cisco License On-Prem,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76454 A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76455 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76464 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76465 A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) fea... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76471 A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an una... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76480 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76482 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76483 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76485 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76486 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76498 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76499 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76500 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76501 A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administratio... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-102828 simple-git, an interface for running git commands in any node.js application, en... |
critical | 9.8 | — | Simple-git Project / simple-git | 2026-09-29 | 2026-10-08 |
| CVE-2020-9548 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction betwee... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2020-03-02 | 2026-10-08 |
| CVE-2019-20330 FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache bloc... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2020-01-03 | 2026-10-08 |
| CVE-2026-104711 Improper neutralization of special elements used in an expression language state... |
critical | 9.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-93674 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-104334 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93675 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2021-42553 A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in ve... |
critical | 9.8 | — | St / stm32 mw usb host | 2022-10-21 | 2026-10-08 |
| CVE-2026-67269 Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains... |
critical | 9.9 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-95605 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-95606 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Ev... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-85097 The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2022-37897 There is a command injection vulnerability that could lead to unauthenticated re... |
critical | 9.8 | — | Arubanetworks / sd-wan | 2022-12-12 | 2026-10-08 |
| CVE-2026-88877 Traefik is a HTTP reverse proxy and load balancer. |
critical | 9.8 | — | Traefik / traefik | 2026-09-10 | 2026-10-08 |
| CVE-2026-85594 Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restriction... |
critical | 9.8 | — | Traefik / traefik | 2026-09-04 | 2026-10-08 |
| CVE-2026-85595 Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an... |
critical | 9.8 | — | Traefik / traefik | 2026-09-04 | 2026-10-08 |
| CVE-2026-85596 Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in th... |
critical | 9.8 | — | Traefik / traefik | 2026-09-04 | 2026-10-08 |
| CVE-2026-85597 Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict... |
critical | 9.1 | — | Traefik / traefik | 2026-09-04 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.