October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107584 Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when applying DANE... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107573 Incorrect default permissions in the Windows installer of Progressive Robot hMai... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107574 Inefficient algorithmic complexity in the JSON reader of Progressive Robot hMail... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107576 Inefficient algorithmic complexity in the inbound DKIM and ARC signature verific... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107577 Inefficient algorithmic complexity and a non-terminating loop in the MIME proces... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107579 Inefficient algorithmic complexity in the bounce and complaint processing of Pro... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104659 Missing Host header validation and missing throttling of failed administrator si... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104660 Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 thro... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104704 Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbo... |
high | 7.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103649 Missing network timeouts in the Linux builds of Progressive Robot hMailServer 6.... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-104658 The Linux live-update apply helper (hmailserver-update) of Progressive Robot hMa... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103010 Heap-based buffer overflow in the legacy Blowfish decryption routine (BlowFishEn... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103647 Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 throu... |
high | 8.0 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71183 An authorization vulnerability in Apache DolphinScheduler allows authenticated u... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-71895 An authorization vulnerability in Apache DolphinScheduler allows authenticated n... |
high | 7.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66084 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-66087 An authorization bypass vulnerability in Apache DolphinScheduler allows authenti... |
high | 8.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87424 A vulnerability in the SupportLink API authentication component of Brocade ASCG... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-87428 In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can i... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85422 A vulnerability in Brocade ASCG version before 3.5.0 could allow an attacker to... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85423 A vulnerability has been identified in the data collection service of Brocade AS... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85486 Brocade ASCG before 3.5.0 improperly processes user input by evaluating form dat... |
high | 8.0 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85487 A path traversal vulnerability exists in the HTTP service component of Brocade A... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85488 Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in... |
high | 7.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85489 An authentication flaw exists in the Brocade ASCG administrative management serv... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85490 When Brocade ASCG before 3.5.0 processes support bundle archives ingested from r... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-85421 A critical security vulnerability has been identified in Brocade ASCG versions b... |
high | 8.8 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various exter... |
high | 8.0 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-103309 The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who c... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interfa... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authenticatio... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of B... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the acc... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-17196 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87687 An authorization and input validation vulnerability exists in Brocade Fabric OS... |
high | 7.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnos... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon o... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in th... |
high | 7.1 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management sub... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.