CVE Statistics: October 2026

🌐 Discover the key figures for vulnerabilities published in October 2026 on CVE Find.

🔎 Overview

• Total number of CVEs published : 17,480 (+16% vs the previous month)
• Vulnerabilities added to the CISA KEV catalog : 35

📂 Breakdown by main categories

• Authorization problems : 2787
• Cross-site Scripting : 1405
• Overflow : 1253
• Memory Corruption : 826
• SQL Injection : 558
• Directory Traversal : 476

📈 Breakdown by CVSS score

• Low : 632
• Medium : 6326
• High : 5914
• Critical : 1372

🏢 Most affected vendors

1. microsoft : 652
2. google : 331
3. ibm : 108
4. adobe : 95
5. broadcom : 55

📦 Most affected products

1. microsoft windows_server_2025 : 376
2. microsoft windows_server_2022 : 360
3. microsoft windows_11_26h2 : 357
4. microsoft windows_11_25h2 : 356
5. microsoft windows_11_24h2 : 356

⚠️ Notable CVEs of the month

• CVE-2026-61826 (10 CRITICAL) : Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource h...
• CVE-2026-61738 (10 CRITICAL) : SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, `POST /api/scoutsuite/generate-gcp-report` in `backend/a...
• CVE-2026-84295 (10 CRITICAL) : Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive ...
• CVE-2026-61991 (10 CRITICAL) : Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
• CVE-2026-61567 (10 CRITICAL) : AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login:...

Explore all the data in detail on CVE Find.