October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,875
Critical
1,275
High
5,586
Medium
5,955
Low
624
Severity not reported
3,435
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76483 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76464 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.6 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76465 A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) fea... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76459 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-76454 A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Pre... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76455 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-62176 PraisonAI is a multi-agent teams system. |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-62252 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-62253 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-20328 A vulnerability in the web-based management interface of Cisco License On-Prem,... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92414 : Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabb... |
critical | 9.1 | — | Apache / jackrabbit | 2026-10-07 | 2026-10-13 |
| CVE-2026-107204 LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerab... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107206 LMCache through 0.5.5 contains a missing authentication vulnerability in the mul... |
critical | 9.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107202 A command injection vulnerability exists in the h-ui (version v0.0.25 and below)... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70521 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70520 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70518 The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-70516 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-102255 A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Pla... |
critical | 10.0 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-96408 A code injection vulnerability exists in the upgrade script of Movable Type, whi... |
critical | 9.4 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105192 LMCache multiprocess mode, also called distributed mode, opens an unauthenticate... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-29 |
| CVE-2026-97720 Incorrect implementation of JWT/OAuth authentication in Impala executors in Apac... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-59346 VMware Workstation and Fusion contain an integer-overflow vulnerability. |
critical | 9.3 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-81535 In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/interna... |
critical | 9.1 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-93674 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93675 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-104334 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-106501 Backstage is an open framework for building developer portals. |
critical | 9.6 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-101023 Gitea's OAuth2 token endpoint verified the signature and grant of a token submit... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106486 Backstage is an open framework for building developer portals. |
critical | 9.9 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-bitbucket-cloud | 2026-10-06 | 2026-10-23 |
| CVE-2026-105812 Improper control of code generation in the agent import functionality of Amazon... |
critical | 9.0 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-94205 Gitea Actions decided whether a fork pull request run needed approval based on t... |
critical | 9.8 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-95106 Gitea accepted pushed Git trees containing two entries with the same name, which... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-79805 An authenticated path traversal vulnerability exists in ClearPass Policy Manager... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79796 Vulnerabilities have been identified in the affected interface of ClearPass Poli... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79798 SQL injection vulnerabilities in the web-based management interface of ClearPass... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-79801 A missing integrity verification vulnerability in the client agent software of H... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76747 Buffer overflow vulnerabilities exist in the affected interface of AOS-S. |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-76750 Deserialization of untrusted data vulnerabilities exist in the web interface of... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
| CVE-2026-76751 A missing integrity verification vulnerability exists in the OnGuard agent of Cl... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.