October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101954 An Improper Authentication vulnerability in the J-Web management interface and i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-77524 KEDA is a Kubernetes-based Event Driven Autoscaling component. |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability |
critical | 9.8 | Listed | Cisco / Secure Email Gateway | 2026-10-14 | 2026-10-15 |
| CVE-2026-33796 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33792 A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Net... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109439 Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 cont... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102182 A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-102175 A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102178 A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102031 An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101990 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101980 An Integer Underflow vulnerability in the kernel of Juniper Networks Junos OS wi... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101986 An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS a... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101956 An Improper Authentication vulnerability in the J-Web web management component o... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101950 A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-91881 Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improp... |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89068 Missing critical step in authentication vulnerability in Progress MOVEit Transfe... |
critical | 9.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89073 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-86002 Dokku is a docker-powered platform as a service. |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the re... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110645 Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110649 Stills before 25.24.2 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110650 The thumbnail Python package through 1.5 contains an OS command injection vulner... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110639 @mborne/extract before 0.2.1 contains an OS command injection vulnerability that... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110640 Whisper-node through 1.1.1 contains an OS command injection vulnerability that a... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110643 transcribe2texts through 1.0.6 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110644 nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in c... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110634 git-diff before 2.0.7 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110635 webp-converter before 3.0.0 contains an OS command injection vulnerability in sr... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110636 pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110638 doc-recog through 1.1.6 contains an OS command injection vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110631 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Peri... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110612 vlife through 2.0.1 contains an authentication bypass vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2020-37282 office-converter through 1.0.2 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-108065 SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-16741 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-16740 Missing authentication for critical function vulnerability in TR7 Cyber Defense... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108291 Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107424 Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashbo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.