October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,216
Critical
1,207
High
5,399
Medium
5,736
Low
602
Severity not reported
3,272
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76268 In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-95605 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-95606 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Ev... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76501 A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administratio... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76485 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76486 A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) fe... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76498 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76499 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76500 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76471 A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an una... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76480 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76482 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76483 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76464 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76465 A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) fea... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76459 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-76454 A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76455 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-62176 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-62252 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-62253 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-20328 A vulnerability in the web-based management interface of Cisco License On-Prem,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabb... |
critical | 9.1 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-107204 LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerab... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107206 LMCache through 0.5.5 contains a missing authentication vulnerability in the mul... |
critical | 9.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107202 A command injection vulnerability exists in the h-ui (version v0.0.25 and below)... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70521 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70520 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70518 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70516 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Pla... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-96408 A code injection vulnerability exists in the upgrade script of Movable Type, whi... |
critical | 9.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticate... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97720 Incorrect implementation of JWT/OAuth authentication in Impala executors in Apac... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-59346 VMware Workstation and Fusion contain an integer-overflow vulnerability. |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-81535 In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/interna... |
critical | 9.1 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-93674 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93675 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-104334 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-106501 Backstage is an open framework for building developer portals. |
critical | 9.6 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.