October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65142 NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause dese... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-86684 The Gitea push mirror API checked whether the repository owner, instead of the r... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106509 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106500 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106503 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106505 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106498 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-105267 The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requi... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failur... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can in... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106550 Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Se... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106488 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-oidc-provider | 2026-10-06 | 2026-10-22 |
| CVE-2026-106457 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-cloudflare-access-provider | 2026-10-06 | 2026-10-27 |
| CVE-2026-106459 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-sentry | 2026-10-06 | 2026-10-13 |
| CVE-2026-106455 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-13 |
| CVE-2026-106062 A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-16 |
| CVE-2026-101258 A flaw was found in Ghostscript. |
high | 7.8 | — | — | 2026-10-06 | 2026-10-15 |
| CVE-2026-96399 A repository's external issue tracker regular expression containing alternating... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96404 When Gitea's web installer is reachable against a database that already contains... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-96580 Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian pro... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-89430 Gitea validated a push mirror's remote address against the `[migrations]` allow... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79960 When a push was authenticated with a deploy key, Gitea recorded the repository o... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79806 A privilege escalation vulnerability in the ClearPass Policy Manager OnGuard Lin... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79807 A missing integrity verification vulnerability in the Windows client software fo... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79808 A buffer overflow vulnerability exists in the OnGuard agent of ClearPass Policy... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79809 An unauthenticated path traversal vulnerability exists in an API endpoint of Cle... |
high | 7.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79810 Remote code execution vulnerabilities exist in the affected interface of HPE Net... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79811 A SQL injection vulnerability in the API of ClearPass Policy Manager could allow... |
high | 7.2 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79797 An improper access control vulnerability exists in the Android client applicatio... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79799 A vulnerability in the web-based management interface of ClearPass Policy Manage... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-79800 An authenticated path traversal vulnerability exists in the command line interfa... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79802 A command injection vulnerability exists in the client software of ClearPass Pol... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79803 A command injection vulnerability exists in the API of ClearPass Policy Manager. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76748 A privilege escalation vulnerability exists in the API of AOS-S. |
high | 8.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-70357 Gitea validates a repository migration hostname against its network allow and bl... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104626 A user who can open a fork pull request can place workflow content with a shared... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104632 Gitea Actions blocks the jobs of workflow runs from first-time fork pull request... |
high | 8.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-104636 Gitea validated the initial remote URL for push mirrors, wiki remote checks, and... |
high | 7.5 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-103009 Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can... |
high | 7.1 | — | Elastic / elasticsearch | 2026-10-06 | 2026-10-09 |
| CVE-2026-103504 Changing an organization team's permission through the API with only the `permis... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.