October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,863
Critical
1,275
High
5,585
Medium
5,952
Low
622
Severity not reported
3,429
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-27874 : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 al... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102514 Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, un... |
not reported | — | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2026-102370 Kasa EC70 v4
and EC71 v4 do not logically disable the production debug interface... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-70650 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-71426 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-71542 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55252 OpenRun is an open-source, self-hosted GitOps platform for deploying web apps an... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-14983 Missing authentication in the web interface in Teledyne FLIR Aware2 versions thr... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-14984 Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-8618 A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/b... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-63721 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-63724 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-01 | 2026-10-16 |
| CVE-2026-84682 A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) o... |
not reported | — | — | — | 2026-10-01 | 2026-10-23 |
| CVE-2026-27872 - Improper Privilege Management vulnerability in Johnson Controls Easy IO FG all... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-9032 Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboard... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-73976 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-78577 Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan fu... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78578 Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboa... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103923 KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the we... |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-102294 TP-Link TL-WR841N contains an authenticated OS command injection vulnerability i... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-102369 Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanit... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-73975 djehuty is a research data repository system developed by 4TU.ResearchData. |
not reported | — | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-94620 Classroom 50 is a free and open-source tool for managing and grading programming... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-18734 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101322 In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95137 Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94250 Allocation of resources without limits or throttling vulnerability in batch-requ... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94269 Use of Non-Canonical URL paths for authorization decisions vulnerability in Apac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94276 Improper Authentication vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103858 MISP contains an incomplete authorization check in the discussion posting functi... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94212 Improper verification of cryptographic signature vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94220 Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82806 Exposure of data element to wrong session vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78242 Insertion of sensitive information into log file vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/cust... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64948 Missing authorization in module data retrieval allows unauthorized cross-group a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64949 Incomplete extension blacklist in the File Manager module allows authenticated u... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64950 Missing input validation and output encoding on the directory name parameter in... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-75786 Unsanitized concatenation of the module parameter in the Grafana datasource endp... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7173 CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.