October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,181
Critical
1,306
High
5,739
Medium
6,115
Low
636
Severity not reported
3,385
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (129), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79893 Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remot... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79894 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI prot... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79877 A remote code execution vulnerability in the underlying operating system of AOS-... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79878 A command injection vulnerability in the AOS-8 command line interface accessed b... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79879 Memory corruption vulnerabilities in the affected interface of AOS-10 could lead... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79880 A vulnerability in the command line interface of AOS-8 could allow an authentica... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79881 An authentication bypass vulnerability in the underlying operating system of AOS... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79882 There is a command injection vulnerability in the PAPI protocol of AOS-10 that c... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 co... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79884 A vulnerability in the web-based management interface of AOS-8 could allow an un... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might a... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115392 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0... |
high | 7.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115371 Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115374 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verificatio... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115352 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115353 Mistune before 3.3.0 contains a path traversal vulnerability in the RST include... |
high | 8.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include dire... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115347 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerabilit... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115348 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115349 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of ser... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-114648 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionar... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114613 MessagePack is the serializer implementation for Python msgpack.org. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-97635 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided inpu... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-13599 Missing authentication for critical function vulnerability in ABB Ability Edgeni... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113873 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113874 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identi... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115513 OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-75507 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-75508 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114605 dnspython is a DNS toolkit for Python. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processin... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-104068 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115482 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113872 multer is a middleware for Node.js that handles multipart/form-data file uploads... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114510 Flexible GraphRAG is a Python framework for building graph and retrieval-augment... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-61791 OCO-Server is a self-hosted endpoint management application for computer invento... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-111181 body-parser is body parsing middleware for Node.js and Express. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-92709 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.