October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95208 An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfS... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-30 |
| CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14497 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14507 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticat... |
high | 7.7 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14905 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14496 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107639 ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument i... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107589 Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107286 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.5 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-105830 league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of s... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-105833 EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-91844 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Ser... |
high | 7.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16161 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16163 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.6 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16164 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16165 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-16167 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-15781 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.0 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15784 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15819 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15822 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15824 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.2 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16111 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16159 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 8.6 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-107615 An uncontrolled search path element vulnerability in GlavSoft TightVNC Server fo... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107611 An out-of-bounds read vulnerability in the ZRLE decoder of GlavSoft TightVNC Vie... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107612 Incorrect permission assignment in GlavSoft TightVNC Server for Windows before 2... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-62142 Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allow... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66479 Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComp... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-44031 Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16178 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16179 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16181 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.4 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-106611 Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminato... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-16169 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote attacker to... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16170 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16176 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-105076 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-19083 Authorization bypass through User-Controlled key vulnerability in AKIN Software... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.