Month report
October 2026
Rolled up 2026-10-04 04:40 from 381,139 CVE records
889 CVEs published, -79.2% on the same month last year. 78 rated critical, 3 listed by CISA as exploited. apache led with 97; the most common weakness class was CWE-79 (162). hcl software climbed 82 places, the largest move. 21 vendors ranked for the first time.
Published
889
Critical / high
78 / 369
Medium / low
370 / 33
Added to CISA KEV
3
Public exploit
16
Scanner template
0
Publication to KEV
How long before CISA listed them
Median days to listing
0
Listed within 7 days
100%
Listed within 30 days
100%
Weakness × vendor
Where the two overlap
| Vendor | CWE-79 | CWE-862 | CWE-89 | CWE-770 | CWE-22 | CWE-639 | CWE-918 | CWE-306 |
|---|---|---|---|---|---|---|---|---|
| apache | 22 | 1 | ||||||
| legion of the bouncy castle | 5 | |||||||
| yeswiki | 6 | 3 | 4 | 2 | 7 | 1 | ||
| tryghost | 5 | 3 | 2 | 1 | 2 | |||
| redhat | 1 | 2 | 2 | |||||
| zcashfoundation | 2 | |||||||
| n8n io | 1 | 2 | 2 | 2 | 3 | |||
| repasat | 16 |
Detection gap
Listed as exploited, no public template
Listed this month
3
With a template
0
No template
3
Measured against the nuclei-templates CVE index only. No template there does not mean a CVE is undetectable by any other tool.
Vendors
Ranked by distinct CVEs this month
| # | Vendor | Top products | ||||||
|---|---|---|---|---|---|---|---|---|
| 1 | apache | 97 | 6 | 2 | apache thrift (61) · apache http server (20) · apache apisix (7) | ↑9 | ||
| 2 | legion of the bouncy castle | 36 | 2 | bc csharp (21) · bc java (14) · bc lts java (6) | · | |||
| 3 | yeswiki | 36 | yeswiki (36) | · | ||||
| 4 | tryghost | 34 | ghost (34) | new | ||||
| 5 | redhat | 20 | 2 | red hat satellite 6 16 for rhel 8 (11) · red hat satellite 6 16 for rhel 9 (11) · red hat satellite 6 17 for rhel 9 (11) | ↑1 | |||
| 6 | zcashfoundation | 18 | zebra (18) | new | ||||
| 7 | n8n io | 16 | 2 | n8n (16) | ↑41 | |||
| 8 | repasat | 16 | repasat application (16) | new | ||||
| 9 | hcl software | 14 | hcl bigfix service management (8) · icontrol (5) · aion (1) | ↑82 | ||||
| 10 | misp | 14 | 1 | misp (14) | ↑7 | |||
| 11 | johnson controls | 12 | 1 | easyio fs32 (7) · easy io fg (1) · easy io neo (1) | · | |||
| 12 | 11 | 2 | chrome (11) | ↓9 | ||||
| 13 | jetbrains | 10 | youtrack (10) | ↑10 | ||||
| 14 | openidentityplatform | 9 | openam (9) | ↑59 | ||||
| 15 | fortra | 8 | 3 | boks manager (3) · boks manager boks server (2) · core privileged access manager boks (2) | · | |||
| 16 | pandora fms | 8 | pandora fms (8) | · | ||||
| 17 | aws | 7 | 2 | 1 | loom (3) · aws efs csi driver (1) · powertools lambda python (1) | ↑42 | ||
| 18 | getsimplecms ce | 7 | 3 | getsimplecms ce (7) | new | |||
| 19 | tp link systems | 7 | tapo c120 v1 (4) · tapo c200 v5 (4) · archer ax90 v1 (1) | · | ||||
| 20 | utmstack | 7 | 2 | utmstack (7) | new | |||
| 21 | vercel | 7 | next js (7) | · | ||||
| 22 | genians | 6 | 1 | genian ssl pns frodo core (3) · genian nac 5 0 75 lts release (2) · genian nac 5 0 85 release stable (2) | · | |||
| 23 | hitachi industrial equipment systems | 6 | 4 | hitachi coding software suite (6) | new | |||
| 24 | joyland | 6 | joyland ai (6) | new | ||||
| 25 | teledyne flir | 6 | 3 | aware2 (6) | new | |||
| 26 | itsourcecode | 5 | leave management system (2) · pet shop management system (2) · online admission system project (1) | ↑6 | ||||
| 27 | armatura | 4 | armatura one (4) · armatura one usa (4) | new | ||||
| 28 | codepeople | 4 | calculated fields form ai form builder for wordpress contact payment quote quiz more (3) · appointment hour booking booking calendar (1) | · | ||||
| 29 | crocantickets | 4 | entradium (4) | new | ||||
| 30 | havelsan | 4 | sef ai chatbot platform (4) | new | ||||
| 31 | kvcache ai | 4 | 2 | mooncake (4) | new | |||
| 32 | monta | 4 | 1 | monta app (4) | new | |||
| 33 | thimpress | 4 | learnpress (2) · learnpress wordpress lms plugin for create and sell online courses (2) | · | ||||
| 34 | villatheme | 4 | photo reviews for woocommerce (2) · affi affiliate marketing for woocommerce (1) · buildkit product builder for woocommerce custom pc builder (1) | new | ||||
| 35 | webrehab | 4 | 2 | 1 | super forms drag drop form builder (4) | new | ||
| 36 | wpclever | 4 | wpc estimated delivery date for woocommerce (1) · wpc product options for woocommerce (1) · wpc shop as a customer for woocommerce (1) | · | ||||
| 37 | asus | 3 | 1 | router (2) · motherboard prime z390 a (1) · motherboard prime z390 a h10 (1) | · | |||
| 38 | codeastro | 3 | simple pharmacy management system (2) · simple loan management system (1) | · | ||||
| 39 | codexonics | 3 | prime mover (3) | new | ||||
| 40 | formtools org | 3 | form tools (3) | new | ||||
| 41 | geovision | 3 | gv eye (3) | ↑14 | ||||
| 42 | givanz | 3 | vvveb (3) | · | ||||
| 43 | nrwl | 3 | nx (3) | new | ||||
| 44 | onetwothreeneth | 3 | hospitalmanagementsystem (3) | new | ||||
| 45 | roxnor | 3 | wp ultimate review (2) · wp social login and register social counter (1) | · | ||||
| 46 | siyuan note | 3 | siyuan (3) | ↓18 | ||||
| 47 | smub | 3 | all in one seo ai seo plugin to boost seo rankings traffic schema local seo sitemap seo insights (2) · smash balloon social post feed simple social feeds for wordpress (1) | · | ||||
| 48 | tornadoweb | 3 | tornado (3) | new | ||||
| 49 | unlimited elements | 3 | unlimited elements for elementor free widgets addons templates (3) | new | ||||
| 50 | webpros | 3 | 3 | cpanel (3) · wp squared (3) | ↑32 |
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored. The KEV column counts CVEs published in 2026-10 that are on the CISA KEV catalog today. The 3 in the headline is what CISA listed during the month, whenever those CVEs were published. All 50 ranked vendors are listed; a zero count renders as a dot.
Weaknesses
CWE classes by distinct CVEs
- 1CWE-791622 critical—
- 2CWE-862582 critical—
- 3CWE-89412 critical↑1
- 4CWE-770351 critical↑18
- 5CWE-22336 critical↑3
- 6CWE-639270 critical↑5
- 7CWE-918271 critical↑5
- 8CWE-306249 critical↑7
- 9CWE-200210 critical↑1
- 10CWE-863202 critical↓3
- 1CWE-287176 critical↑8
- 2CWE-352172 critical↑15
- 3CWE-78154 critical↑1
- 4CWE-284142 critical↓11
- 5CWE-295131 critical↑19
- 6CWE-94134 critical—
- 7CWE-269123 critical↓4
- 8CWE-74120 critical↑2
- 9CWE-248100 critical↑42
- 10CWE-285100 critical↑10
One CVE is counted once per vendor, product or weakness class it lists, so a ranking column sums to more than the month's total. Only the month's top 100 keys per dimension are stored.