October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95598 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95599 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94641 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94661 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94663 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94664 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94666 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94668 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94166 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94167 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94170 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94415 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94568 Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94632 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78339 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78341 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.2 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-94158 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94159 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94161 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78023 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78024 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.7 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78025 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.5 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78026 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78018 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 7.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78019 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-78020 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-14 |
| CVE-2026-78022 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.1 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-76769 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-98378 In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip u... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98381 In the Linux kernel, the following vulnerability has been resolved:
veth: manag... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98382 In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-98383 In the Linux kernel, the following vulnerability has been resolved:
bpf: Disall... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-19575 The user-mode verification handler for the device_deinit() system call, z_vrfy_d... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-98376 In the Linux kernel, the following vulnerability has been resolved:
bpf: Use ar... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-24 |
| CVE-2026-106145 In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect pri... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-106155 In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cros... |
high | 8.9 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-19569 dynamic_object_create() in kernel/userspace/userspace.c computed the backing all... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-19570 The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copie... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-19574 The ARM64 MMU back-end allocated address space identifiers (ASIDs) for memory do... |
high | 7.0 | — | — | 2026-10-09 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.