October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,462
Critical
1,337
High
5,864
Medium
6,249
Low
648
Severity not reported
3,364
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107450 In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutatio... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2023-5648 In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers... |
medium | 6.1 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2023-5649 An Improper Input Validation vulnerability for the registered case credentials i... |
medium | 5.5 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-94575 A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management... |
medium | 5.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94580 An arbitrary file and directory deletion vulnerability exists in the REST API ma... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87685 An arbitrary file manipulation vulnerability exists in the WebTools management i... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87688 An input validation vulnerability exists in the security certificate management... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87675 An OS command injection vulnerability exists in the configuration management sub... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87667 An argument injection vulnerability exists in the configuration management comma... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-107445 A flaw was found in Katello where the Flatpak Remote Repositories API does not p... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2026-107446 containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) int... |
medium | 6.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107444 A flaw was found in Katello where the Docker Tags repositories API does not prop... |
medium | 4.3 | — | — | 2026-10-08 | 2026-10-29 |
| CVE-2026-87678 An input validation and output encoding vulnerability exists in the web manageme... |
medium | 5.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87686 An authentication and access control bypass vulnerability exists in the web serv... |
medium | 4.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-92861 The Android application "Ticket Ryutsu Center" contains hard-coded credentials,... |
medium | 4.0 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87668 A stack-based buffer overflow vulnerability exists in the diagnostic execution u... |
medium | 6.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87669 A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST A... |
medium | 4.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87670 An authorization logic vulnerability exists in the Brocade Fabric OS versions be... |
medium | 4.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87672 An information disclosure vulnerability exists in the SupportLink diagnostic col... |
medium | 5.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87676 A stack-based buffer overflow vulnerability exists in the security library compo... |
medium | 5.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2017-20283 NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the... |
medium | 6.5 | — | — | 2026-10-08 | 2026-10-15 |
| CVE-2024-8122 The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time... |
medium | 5.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-87681 An Access Control Bypass vulnerability exists in the Role-Based Access Control (... |
medium | 6.3 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-17538 The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulner... |
medium | 5.4 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-94154 The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value... |
medium | 5.3 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107314 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107285 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities t... |
medium | 5.9 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-105820 Vault's ACL policy cache allowed namespace traversal when policy names contained... |
medium | 5.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76286 In Splunk MCP Server versions below 1.2.1, Splunk MCP Server could send the Splu... |
medium | 5.3 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-76278 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that hol... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76279 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76280 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Spl... |
medium | 6.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76281 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | — | — | Splunk / splunk | 2026-10-07 | 2026-10-27 |
| CVE-2026-76271 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privilege... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76272 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76273 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76274 In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that hol... |
medium | 6.5 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2026-76275 In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user... |
medium | 4.3 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.