October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79870 An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79871 A sensitive information disclosure vulnerability in the command line interface o... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79872 A buffer overflow vulnerability exists in the underlying operating system of AOS... |
critical | 9.4 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79873 Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79874 An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79875 A vulnerability has been identified in the PAPI protocol of AOS-8 that could pot... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79858 An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AO... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79859 Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that co... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79860 Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that cou... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79861 There is a command injection vulnerability in AOS-10 that could lead to unauthen... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79862 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79863 Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 cou... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79864 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79865 A memory corruption vulnerability in the affected interface of AOS-10 could allo... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79866 An unauthenticated path traversal vulnerability exists in the PAPI protocol in A... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79849 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79850 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79851 Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that c... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79852 A vulnerability in the web-based management interface of AOS could allow an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79853 Sensitive information disclosure vulnerabilities in the affected interface of AO... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79854 A vulnerability in the affected interface of AOS-10 could allow an unauthenticat... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79855 An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unau... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79856 A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79857 There is a command injection vulnerability in the PAPI protocol (Aruba's access... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79844 Authentication bypass vulnerabilities in the affected interface of AOS-10 could... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79846 Command injection vulnerabilities exist in the affected interface of AOS-8 that... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79847 Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead t... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79848 Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticate... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer o... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulner... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115377 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2025-65200 An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability tha... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114611 OCO-Server is a self-hosted endpoint management application for computer invento... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114607 Better Auth is an authentication and authorization library for TypeScript. |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-78846 Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP l... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google... |
critical | 9.8 | Listed | Google / brotli | 2026-10-22 | 2026-10-28 |
| CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2022-51022 YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.