CVEs published in October 2026

CVE-2026-87480High

CVE-2026-87479High

CVE-2026-87478High

CVE-2026-87477High

CVE-2026-87474High

CVE-2026-87473High

CVE-2026-87472High

CVE-2026-87469High

CVE-2026-87467High

CVE-2026-87466High

CVE-2026-87464High

CVE-2026-87463High

CVE-2026-87462High

CVE-2026-87461High

CVE-2026-87459High

CVE-2026-87458High

CVE-2026-87457High

CVE-2026-87456High

CVE-2026-87455High

CVE-2026-87454High

CVE-2026-87453High

CVE-2026-87451High

CVE-2026-87450High

CVE-2026-87449High

CVE-2026-87448High

CVE-2026-87447High

CVE-2026-87446High

CVE-2026-87445High

CVE-2026-87442High

CVE-2026-87441High

CVE-2026-87440High

CVE-2026-87439High

CVE-2026-87438High

CVE-2026-87437High

CVE-2026-87436High

CVE-2026-87435High

CVE-2026-87434High

CVE-2026-87433High

CVE-2026-87432High

CVE-2026-87431High

CVE-2026-87430High

CVE-2026-87429High

CVE-2026-85053High

CVE-2026-85052High

CVE-2026-85051High

CVE-2026-85050High

CVE-2026-85048High

CVE-2026-85047High

CVE-2026-85046HighCISA KEV

Google Chromium V8 Type Confusion Vulnerability

CVE-2026-85045High

CVE-2026-85044High

CVE-2026-85043High

CVE-2026-85042High

CVE-2026-76524High

Open Source Snort 3 Control Channel Socket Arbitrary Command Execution Vulnerability

CVE-2026-76519CriticalCISA KEV

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CVE-2026-76489Medium

CVE-2026-76445Medium

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

CVE-2026-20356Critical

CVE-2026-20291Critical

CVE-2026-20236Critical

CVE-2026-20221Medium

Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerability

CVE-2026-20218Medium

Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability

CVE-2026-20197Medium

CVE-2026-20179Medium

CVE-2026-20043Critical

CVE-2026-20019Medium

CVE-2026-20011Medium

Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability

CVE-2026-102308High

CVE-2026-0322HighCISA KEV

Palo Alto Networks PAN-OS Code Injection Vulnerability

CVE-2026-0321High

PAN-OS: Denial of Service (DoS) Vulnerabilities in Network Services

CVE-2026-0320High

PAN-OS: Authenticated Admin Command Injection Vulnerability

CVE-2026-0319High

PAN-OS: Improper Input Handling Vulnerability

CVE-2026-0318High

PAN-OS: Denial of Service (DoS) on Panorama

CVE-2026-0316Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

CVE-2026-0315High

GlobalProtect App: Local Privilege Escalation Vulnerability on macOS

CVE-2026-0314Medium

GlobalProtect App: Local Denial of Service (DoS) on Windows

CVE-2026-0313High

Cortex XSOAR: OS Command Injection Vulnerability

CVE-2026-0312Medium

Checkov by Prisma Cloud: Path Traversal Vulnerabilities

CVE-2026-0311Medium

Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability

CVE-2026-104939High

NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress

CVE-2026-101019High

NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization

CVE-2026-101025Medium

NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails

CVE-2026-95101Medium

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module

CVE-2026-94197High

authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the `ExternalAuth` policy or Ingress external authentication

CVE-2026-96615High

NGINX Gateway Fabric has a vulnerability when it is configured with Gateway Custom Resource Definition (CRD) and have an authenticated gRPC connection with NGINX Agent

CVE-2026-91184High

NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";

CVE-2026-97205Critical

NGINX ngx_http_core_module vulnerability

CVE-2026-93479Critical

vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable

CVE-2026-97629High

When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control

CVE-2026-15176Critical

vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable

CVE-2026-92392High

HTTP/2 upload Use-After-Free

CVE-2026-110459High

malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device

CVE-2026-110458Low

malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device

CVE-2026-110457Low

malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device

CVE-2026-110456Medium

malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device

CVE-2026-110455High

malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device

CVE-2026-110454Medium

malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device

CVE-2026-78404Medium

IBM Db2 Vulnerability in NetApp Products

CVE-2026-71328High

.NET Vulnerability in NetApp Products

CVE-2026-69522High

.NET Vulnerability in NetApp Products