October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,369
Critical
1,327
High
5,803
Medium
6,210
Low
649
Severity not reported
3,380
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1305), google (748), oracle (156), ibm (140), adobe (133), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76142 Insufficient authentication and access control on the internal-only IPC SOAP end... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76143 A missing authorization vulnerability in Genian SSL PNS allows an attacker to by... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76144 An unrestricted file upload vulnerability caused by insufficient file extension... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76145 An improper privilege management vulnerability in Genian SSL PNS allows an attac... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76146 An OS command injection vulnerability in Genian SSL PNS allows an attacker who k... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76147 A path traversal (ZIP Slip) vulnerability caused by insufficient authorization a... |
not reported | — | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-93495 Improper initialization in an ASUS certain motherboard allows an physically prox... |
not reported | — | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-13313 An Active Debug Code vulnerability in certain ASUS router models allows a remote... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-14157 Use of an Externally Controlled Format String in the ASUS Router modules allow a... |
not reported | — | — | — | 2026-10-01 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.