October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87684 A stack-based buffer overflow vulnerability exists in the SNMP daemon request ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87659 A critical authorization bypass vulnerability exists in the Management Server ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can i... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade AS... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form dat... |
high | 8.0 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade A... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management serv... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from r... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions b... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various exter... |
high | 8.0 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interfa... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authenticatio... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of B... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the acc... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS... |
high | 7.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnos... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon o... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in th... |
high | 7.1 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management sub... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94578 Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerab... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94582 A memory buffer overflow vulnerability exists in the internal diagnostic and rou... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87671 An out-of-bounds memory read vulnerability exists in the web management daemon o... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87665 A stack-based buffer overflow vulnerability exists in the Internet Key Exchange... |
high | 7.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87682 Multiple OS Command Injection vulnerabilities exist in the management interface... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87683 Multiple stack-based buffer overflow vulnerabilities exist in the REST API manag... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87679 When Brocade Fabric OS versions before 10.0.1 processes trunk configuration oper... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87680 A command injection vulnerability in the REST API management interface of Brocad... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87425 An unauthenticated remote attacker can modify the TLS client trust store in Broc... |
medium | 6.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87426 An unauthenticated network-based attacker can query specific internal management... |
medium | 4.3 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-5769 A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS sw... |
medium | 4.1 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-5049 A path traversal vulnerability affects the The Zone Alias Import flow feature in... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwor... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94586 A command injection vulnerability exists in the WebTools administrative interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87661 Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly ac... |
medium | 5.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.