October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,954
Critical
1,279
High
5,611
Medium
5,991
Low
633
Severity not reported
3,440
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1300), google (733), ibm (140), adobe (124), oracle (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103858 MISP contains an incomplete authorization check in the discussion posting functi... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94212 Improper verification of cryptographic signature vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94220 Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82806 Exposure of data element to wrong session vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78242 Insertion of sensitive information into log file vulnerability in Apache APISIX. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7176 CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/cust... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64948 Missing authorization in module data retrieval allows unauthorized cross-group a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64949 Incomplete extension blacklist in the File Manager module allows authenticated u... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64950 Missing input validation and output encoding on the directory name parameter in... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-75786 Unsanitized concatenation of the module parameter in the Grafana datasource endp... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7173 CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7174 CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocan... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-7175 CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of th... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34189 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-34190 Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64946 A chained CSRF and unrestricted SVG file upload vulnerability in the File Manage... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-64947 A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin F... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103656 Rejected reason: this is rejected |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103659 MISP contains an authorization bypass in the event flattening feature. |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103662 MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103664 MISP contains a reflected cross-site scripting (XSS) vulnerability in the analys... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103655 MISP contains a vulnerability in its two-factor authentication (TOTP) verificati... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78249 A path traversal vulnerability exists in the web management interface of multipl... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103651 MISP contains a vulnerability in its one-time password (OTP) authentication flow... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-78210 In affected versions of Octopus Server, users with certain scoped permission set... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76142 Insufficient authentication and access control on the internal-only IPC SOAP end... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76143 A missing authorization vulnerability in Genian SSL PNS allows an attacker to by... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76144 An unrestricted file upload vulnerability caused by insufficient file extension... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76145 An improper privilege management vulnerability in Genian SSL PNS allows an attac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76146 An OS command injection vulnerability in Genian SSL PNS allows an attacker who k... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76147 A path traversal (ZIP Slip) vulnerability caused by insufficient authorization a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-93495 Improper initialization in an ASUS certain motherboard allows an physically prox... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-13313 An Active Debug Code vulnerability in certain ASUS router models allows a remote... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.