October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92542 The firewall rules which mark VXLAN datagrams for encryption indiscriminately ma... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-92543 Docker Engine classifies a registry hostname as insecure using an any-match DNS... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107276 MISP contains a race condition in the email-based one-time password (OTP) login... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107278 MISP contains a validation flaw in its object synchronization logic. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-33586 Authenticated users are able to manipulate both the SMTP
envelope “Envelope-from... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107194 Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account t... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-107180 On MISP instances configured to require TOTP enrolment (Security.otp_required),... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-98373 In the Linux kernel, the following vulnerability has been resolved:
mm/hugetlb:... |
not reported | — | — | — | 2026-10-07 | 2026-10-21 |
| CVE-2026-107175 MISP contains a defect in its event save workflow that prevents the correlation... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103435 Claude Code validated that a target file path resided within the project working... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92531 Operating system command injection vulnerability in the SVN integration componen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92532 Unrestricted file upload vulnerability in the BugTracker.NET attachment function... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92533 Path traversal vulnerability in the BugTracker.NET file download component. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97146 Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annota... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-92393 Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation c... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-78243 Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, cra... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-93026 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modif... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107104 This vulnerability exists in the ERP system due to unsafe deserialization of use... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud C... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-5703 Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, sp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64392 This vulnerability in Veeam Backup Enterprise Manager allows an attacker to exec... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execu... |
not reported | — | — | — | 2026-10-07 | 2026-10-24 |
| CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft T... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simp... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-103416 Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclip... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107102 This vulnerability exists in the ERP system due to improper validation of paymen... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-107103 This vulnerability exists in the ERP system due to insufficient validation and p... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2025-64391 This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged... |
not reported | — | — | — | 2026-10-07 | 2026-10-19 |
| CVE-2026-19572 A security vulnerability has been identified in FlexNet Publisher lmadmin. |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-14911 Improper Neutralization of Input During Web Page Generation (“Cross-site Scripti... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19396 A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pai... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105324 An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-16528 Insertion of Sensitive Information into Log File in certain ASUS router models a... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19386 A stack-based buffer overflow in the ASUS router modules allows an authenticated... |
not reported | — | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-102478 In affected versions of Octopus Server, an authenticated user with permission to... |
not reported | — | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-19029 A heap-based buffer over-read in H5Z__filter_scaleoffset() in src/H5Zscaleoffset... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-43598 Improper input validation in the AMD ROCm Communication Collectives Library (RCC... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106547 A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2... |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106451 yawkat LZ4 Java provides LZ4 compression for Java. |
not reported | — | — | — | 2026-10-06 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.