October 2026
4,327 CVEs so far, on pace for about 10,318. CISA has added 9 to KEV.
2026 month by month
- Critical
- 40112% of the 3,484 with a CVSS score
- Added to CISA KEV
- 92 of this month's CVEs are in KEV, listed a median 0 days after publication
- Vendors
- 1,1062,237 products
- Top weakness
- XSSCWE-79 · 498 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1GoogleChrome, Android, Gvisor29326none+2
- 2LinuxLinux2202none−1
- 3Apache Software FoundationApache Thrift, Apache HTTP Server, Apache Cxf1417none+7
- 4IBMDatapower Gateway 11.0.0, Datapower Gateway 10.6.0, Datapower Gateway 10.6cd11719none+1
- 5JeecgbootJeecgboot1000nonenew
- 6Red HatRed Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10954none—
- 7BrocadeFabric OS, Brocade Active Support Connectivity Gateway, Brocade Sannav610none+182
- 8TryghostGhost540nonenew
- 9BackstageBackstage411nonenew
- 10DellSecure Connect Gateway (Scg) Policy Manager, Container Storage Modules, System Update417none−1
- 11@backstagePlugin-scaffolder-backend, Plugin-techdocs-node, Plugin-catalog-backend401nonenew
- 12HPEClearpass Policy Manager (Cppm), Aos-switch (Aos-s), HPE Integrated Lights-out (Ilo) 73817none+1
- 13MakeplanePlane386nonenew
- 14BouncycastleBc-csharp, Bc-java, Bc-lts-java370nonenew
- 15YeswikiYeswiki370none+128
- 16CiscoCisco NX-OS Software, Cisco License On-prem, Cisco NX-OS System Software In Aci Mode3616none—
- 17Mediatek Inc.MT8668 Firmware, MT8793 Firmware, MT6993 Firmware310nonenew
- 18Mediatek, Inc.Mediatek Chipset310none+69
- 19ApacheHTTP Server, LOG4NET, Struts304none+5
- 20GiteaGitea305nonenew
- 21PayloadcmsPayload293nonenew
- 22Arista NetworksCloudvision Cue, Cloudvision Portal, Wi-fi Access Points242none+10
- 23GoCode.vikunja.io/api, Github.com/corazawaf/coraza/v3, Github.com/siyuan-note/siyuan/kernel240none+152
- 24LangflowLangflow242none+16
- 25Progressive Robot LtdHmailserver240nonenew
Severity
How this month's CVEs score on CVSS; 843 have no score yet. Severity is not exploitation.
- Critical401
- High1,321
- Medium1,614
- Low148
Breakouts
Vendors with at least three times their own 12-month median.
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS498
- CWE-862Missing Authorization409
- CWE-89SQL Injection211
- CWE-22Path Traversal154
- CWE-863Incorrect Authorization154
- CWE-639Auth Bypass via User Key140
- CWE-918SSRF115
- CWE-200Information Exposure113
- CWE-502Deserialization102
- CWE-94Code Injection89
- CWE-74Injection84
- CWE-787Out-of-bounds Write84
- CWE-306Missing Auth for Critical Function79
- CWE-287Improper Authentication74
- CWE-770Allocation Without Limits70
- CWE-78OS Command Injection68
- CWE-125Out-of-bounds Read67
- CWE-400Resource Consumption65
- CWE-416Use After Free65
- CWE-284Improper Access Control62
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins90024% of sector-tagged CVEs
- OSS Libraries47113% of sector-tagged CVEs
- Operating Systems43712% of sector-tagged CVEs
- Enterprise Software37210% of sector-tagged CVEs
- Consumer Software3068% of sector-tagged CVEs
- Networking Infrastructure2597% of sector-tagged CVEs
- Security Products2116% of sector-tagged CVEs
- Hardware Firmware1905% of sector-tagged CVEs
- Cloud & SaaS1785% of sector-tagged CVEs
- 6 smaller sectors358
- Not yet classified38
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 862Missing Authorization | 89SQL Injection | 863Incorrect Authorization | 22Path Traversal | 639Auth Bypass via User Key | 200Information Exposure | 918SSRF | 502Deserialization | 74Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| 37 | 42 | 18 | 1 | |||||||
| Linux | ||||||||||
| Apache Software Foundation | 2 | 1 | 7 | 1 | 1 | 1 | ||||
| IBM | 6 | 4 | 1 | 8 | 1 | 2 | 1 | 3 | ||
| Jeecgboot | 93 | 7 | ||||||||
| Red Hat | 4 | 2 | 2 | 3 | 5 | 3 | 2 | 1 | 1 | |
| Brocade | 1 | 1 | 1 | 4 | 1 | |||||
| Tryghost | 11 | 4 | 5 | 4 | 1 | 5 | ||||
| Backstage | 2 | 11 | 11 | 3 | 4 | 1 | ||||
| Dell | 2 | 1 | 3 | 2 | 2 | |||||
| @backstage | 2 | 11 | 11 | 3 | 4 | 1 | ||||
| Hewlett Packard Enterprise (HPE) | 2 | 3 | 3 | 2 | 1 |
In the news
The CVEs security news mentioned most in October 2026.
- CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye...15—
- CVE-2026-88779Memory overflow vulnerability leading to Denial of Service137.5
- CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker coul...1110.0
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands119.8
- CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of Service118.1
- CVE-2026-76504Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability89.8
- CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4...79.8
- CVE-2026-15409A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make...710.0
- CVE-2026-15410Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could ...67.2
- CVE-2026-102489Undisclosed RCE in Zammad v6.3 and higher59.8
- CVE-2026-102490Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package57.8
- CVE-2026-35273Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily explo...59.8
CVEs published in October 2026
89 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2026-104286An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4...KEV9.8
- CVE-2026-88779Memory overflow vulnerability leading to Denial of ServiceKEV7.5
- CVE-2026-102255A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker coul...10.0
- CVE-2026-105134Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection10.0
- CVE-2026-63688Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Missing Authentication for Critical Function vulnerability in the csm-authorization-storage gRPC server. An unauthenticat...10.0
- CVE-2026-63692Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially e...10.0
- CVE-2026-76482Cisco License On-Prem Security Hardening Release10.0
- CVE-2026-97229Integer Overflow or Wraparound in GitLab10.0
- CVE-2026-67269Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privi...9.9
- CVE-2026-79901Predictable Active Directory service-account passwords in BoKS Manager9.9
- CVE-2026-90970Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway9.9
- CVE-2026-93698Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.9.9
- CVE-2026-104711Apache Struts: OGNL injection in the legacy RESTful action mapper9.8
- CVE-2026-105192LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization9.8
- CVE-2026-109390AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on Linux for command execution as root without the victim ap...9.8
- CVE-2026-12627Fortra's Core Privileged Access Manager (BoKS) autoregistration stack buffer overflow vulnerability9.8
- CVE-2026-54472Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially...9.8
- CVE-2026-61421Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the CSM Authorization. An unauthenticated attacker with remote access could po...9.8
- CVE-2026-76268Missing Authentication for Critical Function in the Patroni REST API in Splunk Enterprise9.8
- CVE-2026-76284Improper Neutralization in Splunk Enterprise9.8
- CVE-2026-76455Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities9.8
- CVE-2026-76459Cisco NX-OS Software Security Hardening Release: October 2026 - Out-of-bounds Write Vulnerabilities9.8
- CVE-2026-76465Cisco Nexus 3000 and 9000 Series Switches MPLS OAM Remote Code Execution Vulnerability9.8
- CVE-2026-76471Cisco NX-OS Software NX-API Remote Code Execution Vulnerability9.8
- CVE-2026-76480Cisco License On-Prem Security Hardening Release9.8
- CVE-2026-76485Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability9.8
- CVE-2026-76486Cisco Nexus 3000 and 9000 Series Switches VXLAN OAM (NGOAM) Remote Code Execution Vulnerability9.8
- CVE-2026-76498Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities9.8
- CVE-2026-76499Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Neutralization Vulnerabilities9.8
- CVE-2026-76500Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Control of a Resource Through its Lifetime Vulnerabilities9.8
- CVE-2026-76501Cisco Nexus 9000 Series Switches SRv6 OAM (NGOAM) Remote Code Execution Vulnerability9.8
- CVE-2026-82989CVE-2026-829899.8
- CVE-2026-84411MikroTik RouterOS Integer Underflow9.8
- CVE-2026-85097Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter9.8
- CVE-2026-106197Use after free in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Criti...9.6
- CVE-2026-106358Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Cr...9.6
- CVE-2026-106382Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Cr...9.6
- CVE-2026-67273Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote ac...9.6
- CVE-2026-76464Cisco Meraki Hardening Release October 2026 - Buffer Management Vulnerabilities9.6
- CVE-2026-86360Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote acce...9.6
- CVE-2026-91140OS command injection in Progress Software Autonomous REST Connector GenAI Agents9.6
- CVE-2026-103922Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path9.3
- CVE-2026-59346VMware Workstation and Fusion VMXNET3 integer-overflow vulnerability9.3
- CVE-2026-20328Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability9.1
- CVE-2026-76454Cisco Smart Software Manager On-Prem Unauthenticated API Vulnerability9.1
- CVE-2026-76483Cisco License On-Prem Security Hardening Release9.1
- CVE-2026-79898Fortra BoKS Manager crlserver command injection vulnerability9.1
- CVE-2026-96659Foreman: excessive permissions for viewer role on preview9.1
- CVE-2026-93029There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.9.0
- CVE-2026-93697There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.9.0
- CVE-2026-102406Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception8.8
- CVE-2026-104714Apache Struts: Shared message formatter exposes date and time values across concurrent requests8.8
- CVE-2026-106347Use after free in Track in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)8.8
- CVE-2026-59265Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover8.8
- CVE-2026-76282Improper Control of a Resource Through its Lifetime in Splunk Enterprise8.8
- CVE-2026-76484Cisco License On-Prem Security Hardening Release8.8
- CVE-2026-96940Microsoft Exchange Server Elevation of Privilege Vulnerability8.8
- CVE-2026-86361Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit...8.2
- CVE-2026-86362Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t...8.2
- CVE-2026-59347VMware Workstation and Fusion HGFS stack-based buffer-overflow vulnerability8.1
- CVE-2026-102256Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 appliance which in specific condition...7.8
- CVE-2026-63697Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability,...7.6
- CVE-2026-104712Apache Struts: Disproportionate response size when rendering BigDecimal request parameters7.5
- CVE-2026-63292Apache HTTP Server: mod_vhost_alias stack overflow7.5
- CVE-2026-82988CVE-2026-829887.5
- CVE-2026-105133Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication7.3
- CVE-2026-71168Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access ...7.3
- CVE-2026-102257A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended destination directory using a specially crafted ...7.2
- CVE-2026-20362Cisco Finesse Server-Side Request Forgery Vulnerability7.2
- CVE-2026-50054Zimbra Collaboration Suite GrantRightsRequest SOAP Handler Allows Self-Granting of Undocumented loginAs Mailbox Delegation Right7.1
- CVE-2026-102404Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5
- CVE-2026-103008Uncontrolled Recursion in Elasticsearch Leading to Denial of Service6.5
- CVE-2026-104713Apache Struts: Unbounded request body read in the REST plugin6.5
- CVE-2026-105756vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service6.5
- CVE-2026-10631Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier6.5
- CVE-2026-50055Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion6.5
- CVE-2026-102413Uncaught Exception in Elastic Endpoint Leading to Denial of Service6.2
- CVE-2026-102258Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a rem...6.1
- CVE-2026-109662Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form6.1
- CVE-2026-76281Improper Access Control in Splunk Enterprise5.3
- CVE-2026-42528Apache HTTP Server: mod_dav shared lock overflow4.3
- CVE-2026-42356Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories3.7
- CVE-2025-64393This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- CVE-2026-107406Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
- CVE-2026-18397SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability
- CVE-2026-21589This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center. Crowd Data Center, Crucible and Fisheye...
- CVE-2026-58069This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
- CVE-2026-63277RCE via calcext:data-mappings, sql provider and jdbc connector
- CVE-2026-84286OOB Read/Write via Negative Array Index in exllamav3_ext Kernel Table