October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109157 A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported t... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contai... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63350 Affected devices do not properly restrict executable content contained in import... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89309 The authorization middleware of the WMS MobileServer
fails to require authentica... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109110 A flaw has been found in Wavlink WL-WN592AX6 250422. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109109 A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109108 A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108971 A flaw has been found in D-Link DCS-930L B1.08B4. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97229 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2... |
critical | 10.0 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-87689 The Metasploit Framework Web Service REST API (msf-ws) exposes the credential st... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validat... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks i... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89111 The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-96119 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta... |
critical | 9.9 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-82110 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-82101 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-19622 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass auth... |
critical | 9.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-90920 IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-92116 OAuth1 callback validation vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92119 REST API Mass Assignment vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92120 OAuth1 Request Replay Attack vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109566 Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerabi... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-108929 A flaw has been found in Netcore NR268 1.7.121109. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2025-71429 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-96012 IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109575 In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edit... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-87744 A flaw was found in Quarkus REST Data Panache. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57118 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-77366 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-108917 A vulnerability was determined in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108918 A vulnerability was identified in Edimax BR-6208AC 1.32. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-108915 A vulnerability has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-84286 ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-109321 Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth... |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108907 A vulnerability was determined in Netcore NR268 1.7.121109. |
critical | 10.0 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108914 A flaw has been found in Edimax BR-6208AC 1.32. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-9191 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.6 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.