October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,181
Critical
1,306
High
5,739
Medium
6,115
Low
636
Severity not reported
3,385
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-115497 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109198 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115546 Okta Access Gateway (OAG) does not validate the selected authentication source d... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115484 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115486 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware s... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-96185 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized at... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-24 |
| CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-108456 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized atta... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adap... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115419 The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115504 CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2()... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115505 libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115506 libexpat through 2.9.0 contains a denial of service vulnerability because billio... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112331 Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-95712 A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 c... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95713 An unauthenticated buffer overflow vulnerability exists in the command line inte... |
high | 7.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95704 A vulnerability in the web-based management interface of wireless network manage... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95705 Command injection vulnerabilities in the affected interface of AOS-8 could allow... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95706 Command injection vulnerabilities in the affected interface of AOS-8 could allow... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95707 A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an aut... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95708 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95709 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operat... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95711 An authentication bypass vulnerability in the web-based management interface of... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79895 Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticat... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79955 An unauthenticated memory corruption vulnerability exists in a service accessed... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79956 A vulnerability in the CLI command handling of the AOS-8 web interface could all... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79885 An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79886 An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79887 A vulnerability in the web interface of AOS-8 could allow an unauthenticated rem... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79888 A vulnerability in a certain web interface endpoint of AOS-8 devices could allow... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79889 Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79890 There are command injection vulnerabilities in AOS-8 that could lead to unauthen... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79891 A buffer overflow vulnerability exists in the command line interface of AOS-8 th... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79892 A memory corruption vulnerability exists in AOS-8 that could allow an authentica... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.