October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,200
Critical
3,101
High
7,090
Medium
6,614
Low
672
Severity not reported
4,723
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (125), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-41873 ** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('H... |
critical | 9.8 | — | Apache / pony mail | 2026-04-28 | 2026-10-26 |
| CVE-2026-40010 Missing invocation of Servlet http web request method changeSessionId after sess... |
critical | 9.1 | — | Apache / wicket | 2026-05-06 | 2026-10-26 |
| CVE-2026-49875 Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50627 The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud... |
critical | 9.1 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-50628 A logic error in OAuthRequestFilter rejects legitimate requests originating from... |
critical | 9.8 | — | Apache / cxf | 2026-06-12 | 2026-10-26 |
| CVE-2026-32967 Incorrect Authorization vulnerability of `/v2` experimental interface in Apache... |
critical | 9.1 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-26 |
| CVE-2026-44087 Insufficient Verification of Data Authenticity vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-49871 Cross-Site Request Forgery (CSRF) vulnerability in the cas-auth plugin under def... |
critical | 9.3 | — | Apache / apisix | 2026-06-19 | 2026-10-26 |
| CVE-2026-49268 A remote attacker can inject LDAP special characters into the Distinguished Name... |
critical | 9.1 | — | Apache / shiro | 2026-06-17 | 2026-10-26 |
| CVE-2026-32966 DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metada... |
critical | 9.8 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-25 |
| CVE-2026-39999 Authentication Bypass by Spoofing vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-49230 Improper Validation of Integrity Check Value vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-47898 Improper Restriction of XML External Entity Reference vulnerability in Apache Lu... |
critical | 9.8 | — | Apache / lucene.net | 2026-07-03 | 2026-10-25 |
| CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr... |
critical | 9.1 | — | Apache / doris | 2026-07-14 | 2026-10-24 |
| CVE-2026-62390 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2026-62392 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2023-31039 Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers t... |
critical | 9.8 | — | Apache / brpc | 2023-05-08 | 2026-10-24 |
| CVE-2026-48144 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-55971 Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. |
critical | 9.8 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58023 Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58662 Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. |
critical | 9.1 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-58177 The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver... |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-66756 Improper Protection of Alternate Path vulnerability in Apache Tika. |
critical | 9.8 | — | Apache / tika | 2026-07-30 | 2026-10-23 |
| CVE-2026-68979 Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API me... |
critical | 9.8 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-68980 Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets... |
critical | 9.1 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to... |
critical | 9.8 | — | Apache / tomcat | 2018-05-16 | 2026-10-15 |
| CVE-2017-5648 While investigating bug 60718, it was noticed that some calls to application lis... |
critical | 9.1 | — | Apache / tomcat | 2017-04-17 | 2026-10-15 |
| CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabb... |
critical | 9.1 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-57967 An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH pa... |
critical | 9.8 | — | Apache / artemis | 2026-09-10 | 2026-10-09 |
| CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket... |
critical | 9.8 | — | Apache / log4j | 2017-04-17 | 2026-10-08 |
| CVE-2016-5018 In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.... |
critical | 9.1 | — | Apache / tomcat | 2017-08-10 | 2026-10-08 |
| CVE-2026-104711 Improper neutralization of special elements used in an expression language state... |
critical | 9.8 | — | Apache / struts | 2026-10-05 | 2026-10-08 |
| CVE-2026-91012 org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),... |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-91048 The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2025-54947 In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability invo... |
critical | 9.8 | — | Apache / streampark | 2025-12-12 | 2026-10-07 |
| CVE-2016-1000031 Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Cod... |
critical | 9.8 | — | Apache / commons fileupload | 2016-10-25 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.