October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,191
Critical
3,101
High
7,087
Medium
6,608
Low
672
Severity not reported
4,723
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (125), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109618 PHP Memory Corruption Vulnerability |
critical | 9.8 | Listed | PHP Group / PHP | 2026-10-21 | 2026-10-29 |
| CVE-2026-86384 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-57116 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-48360 Adobe Connect is affected by an Improper Control of Generation of Code ('Code In... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-42922 A authorization bypass vulnerability exists in the /nodered functionality of FUX... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer o... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114611 OCO-Server is a self-hosted endpoint management application for computer invento... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-103792 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109516 The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authen... |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-103780 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability tha... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMs... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-84999 The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115806 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-106013 The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109218 The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2025-65200 An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-118579 A weakness has been identified in D-Link DIR-505 1.10B02. |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-61564 AVideo is a video-sharing Platform. |
critical | 10.0 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-61567 AVideo is a video-sharing Platform. |
critical | 10.0 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118690 Signal K Server before 2.33.0 contains a missing authentication vulnerability th... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-91243 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
critical | 9.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91250 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91251 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91241 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-9659 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-63190 FearlessCMS is a flat-file `content` management system centered on simplicity an... |
critical | 9.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-55240 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-47304 Improper verification of cryptographic signature in .NET allows an unauthorized... |
critical | 9.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice m... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice h... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr f... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-117574 A flaw was found in ai-gateway-payload-processing. |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiMail | 2026-10-01 | 2026-10-28 |
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.