October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-s... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-86405 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-85531 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-96809 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96331 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96328 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96330 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94503 Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify... |
critical | 10.0 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-93947 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107935 A path traversal vulnerability was found in gvproxy, the network forwarder provi... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-76779 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-10-09 | 2026-10-13 |
| CVE-2026-107909 A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) a... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107908 A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-7826 A heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-5759 A double free and use-after-free vulnerability in the RdbLoadDeletedNodes functi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-94510 Authorization bypass through user-controlled key in Microsoft Bookings allows an... |
critical | 9.9 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-96207 Improper certificate validation in Microsoft Partner Center allows an unauthoriz... |
critical | 10.0 | — | Microsoft / partner center | 2026-10-08 | 2026-10-15 |
| CVE-2026-88131 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized... |
critical | 9.8 | — | Microsoft / dataverse | 2026-10-08 | 2026-10-15 |
| CVE-2026-77900 Missing authentication for critical function in Azure App Service allows an unau... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same da... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointin... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-84249 IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84035 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84057 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84058 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer over... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84198 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84209 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84246 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-75875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-80381 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-81932 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82895 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82900 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to d... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-107722 fast-jwt provides fast JSON Web Token (JWT) implementation. |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-78401 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
critical | 9.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-78406 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
critical | 9.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.