October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-87866 When built with wolfSSL, curl can successfully validate a pinned public key
hash... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice h... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr f... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice m... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112712 @fastify/middie is the Express-style middleware engine for Fastify. |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X20... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10137 A stack-based buffer overflow vulnerability exists in the boa formUpload() funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10138 A OS command injection vulnerability exists in the boa formUpload() functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10139 A stack-based buffer overflow vulnerability exists in the Mcli functionality of... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10141 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10131 An OS command injection vulnerability exists in the boa formPasswordSetup functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10132 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac func... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-86411 An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP
co... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113867 Thunderbird did not escape attribute values when serializing outgoing XMPP stanz... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-112380 Missing authorization in the WhatsApp group channel in Kiro Crew might allow a r... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-97406 XERJ Console API bearer tokens can bypass the passkey‑only authentication requir... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113802 Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command inj... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113506 A vulnerability has been found in aaPanel up to 8.25.0. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113703 SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its l... |
critical | 9.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113678 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting H... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.