October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,234
Critical
1,207
High
5,403
Medium
5,749
Low
602
Severity not reported
3,273
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107279 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107280 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107281 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107363 In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the proj... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97715 CVE-2026-97715 is
a vulnerability in the client registration process of Secure A... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97716 CVE-2026-97716
is a vulnerability in the connection set up sub-system of Secure... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97717 CVE-2026-97717
is a vulnerability in the proxy sub-system of Secure Access serve... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-97714 CVE-2026-97714
is a is a vulnerability in the authentication sub-system of Secur... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107354 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107355 Rejected reason: ** This candidate has been removed by an organization. |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allo... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92542 The firewall rules which mark VXLAN datagrams for encryption indiscriminately ma... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92543 Docker Engine classifies a registry hostname as insecure using an any-match DNS... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107276 MISP contains a race condition in the email-based one-time password (OTP) login... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107278 MISP contains a validation flaw in its object synchronization logic. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-33586 Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107194 Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account t... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required),... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-98373 In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb:... |
not reported | — | — | — | 2026-10-07 | 2026-10-21 |
| CVE-2026-107175 MISP contains a defect in its event save workflow that prevents the correlation... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103435 Claude Code validated that a target file path resided within the project working... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92531 Operating system command injection vulnerability in the SVN integration componen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92532 Unrestricted file upload vulnerability in the BugTracker.NET attachment function... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97146 Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annota... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92393 Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation c... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-78243 Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, cra... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93026 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modif... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107104 This vulnerability exists in the ERP system due to unsafe deserialization of use... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud C... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-5703 Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, sp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64392 This vulnerability in Veeam Backup Enterprise Manager allows an attacker to exec... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execu... |
not reported | — | — | — | 2026-10-07 | 2026-10-24 |
| CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft T... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclip... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107102 This vulnerability exists in the ERP system due to improper validation of paymen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107103 This vulnerability exists in the ERP system due to insufficient validation and p... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64391 This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.