October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79842 An authentication bypass vulnerability exists in HPE Intelligent Management Cent... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-107779 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107780 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-13 |
| CVE-2026-82344 IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer ove... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-84272 IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentic... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-82334 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-82335 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buff... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-104075 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-104076 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-106126 A command injection vulnerability in the Active Directory Events Listener of Ten... |
critical | 9.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107700 dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107703 @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107704 The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injectio... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107699 ppt2png through 0.0.6 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-93034 SGLang contains an arbitrary code execution vulnerability caused by the ZMQ mess... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-9209 mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulne... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14992 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14502 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14508 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14888 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14988 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14269 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerabil... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14990 IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scr... |
critical | 9.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-14991 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15762 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-16340 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-19218 Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN So... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-92555 Insertion of sensitive information into sent data vulnerability in AKIN Software... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107510 An authenticated high privilege user can inject arguments in troubleshooting com... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105110 OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT d... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-85097 The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107459 The SecuShare Pro developed by Openfind has an OS Command Injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103692 The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any author... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-103646 The Ultimate Multisite WordPress plugin before 2.17.0 does not require authentic... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-17609 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-87684 A stack-based buffer overflow vulnerability exists in the SNMP daemon request ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87659 A critical authorization bypass vulnerability exists in the Management Server ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-76284 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-76285 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.