October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,954
Critical
1,279
High
5,611
Medium
5,991
Low
633
Severity not reported
3,440
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-41545 A relative path traversal vulnerability has been reported to affect QuMagie. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-47786 An OS command injection vulnerability has been reported to affect HybridDesk Sta... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-47790 A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Ser... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34006 A missing authentication for critical function vulnerability has been reported t... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34007 An OS command injection vulnerability has been reported to affect Notes Station... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34008 An incorrect permission assignment for critical resource vulnerability has been... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34009 An improper isolation or compartmentalization vulnerability has been reported to... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-34014 An incorrect permission assignment for critical resource vulnerability has been... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39989 A server-side request forgery (SSRF) vulnerability has been reported to affect D... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18660 In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`,... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18662 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19863 An unauthenticated client may access certain protected resources when using Ethe... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19864 Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-26243 A path traversal vulnerability has been reported to affect Qsync Central. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18659 In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-se... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76182 In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to fo... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76184 In Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/.... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77711 When Jetty's `HttpClient` make a request to a server through a forward proxy, th... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-16438 Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 ve... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-18661 In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-35088 Slican telephone exchanges use symmetric encryption for TCP/IP communication. |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-63314 WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-63315 WebCTI service for Slican IPx telephone exchanges stores temporary subscriber pa... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-16436 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubi... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-16437 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubi... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101287 Authentication bypass vulnerability in Stela, versions prior to 1.60.1, due to t... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-39993 A relative path traversal vulnerability has been reported to affect Download Sta... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-41544 A path traversal vulnerability has been reported to affect QcalAgent. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19377 Improper certificate validation in the tunnel handshake in Cato Client allows a... |
not reported | — | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-22896 A cross-site scripting (XSS) vulnerability has been reported to affect Network &... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-24715 An observable timing discrepancy vulnerability has been reported to affect QuRou... |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-24718 A path traversal vulnerability has been reported to affect Qsync Central. |
not reported | — | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2025-68403 An external control of system or configuration setting vulnerability has been re... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-68404 A time-of-check time-of-use (toctou) race condition vulnerability has been repor... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29897 A buffer copy without checking size of input vulnerability has been reported to... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29895 A NULL pointer dereference vulnerability has been reported to affect Qsync Centr... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-29896 A NULL pointer dereference vulnerability has been reported to affect Qsync Centr... |
not reported | — | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110923 Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110925 Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-110926 Rejected reason: CVE-2026-110926 has been marked as a duplicate of CVE-2026-1065... |
not reported | — | — | — | 2026-10-15 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.