October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,599
Critical
3,298
High
7,980
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42693 Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-29 |
| CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties... |
high | 7.5 | Listed | Atlassian / Multiple Products | 2026-10-05 | 2026-10-29 |
| CVE-2026-115726 Aider through 0.86.2 contains a command execution vulnerability that allows atta... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115505 libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-113912 An out-of-bounds access issue was addressed with improved bounds checking. |
high | 7.1 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-66281 In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can resu... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-66282 In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can r... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-61791 OCO-Server is a self-hosted endpoint management application for computer invento... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-75508 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-25439 Authentication Bypass Using an Alternate Path or Channel vulnerability in Bookne... |
high | 8.1 | — | — | 2026-06-17 | 2026-10-29 |
| CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115332 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /inclu... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48017 OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthent... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-94347 PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-87102 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87103 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83363 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83393 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-85898 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-86379 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86378 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83361 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimb... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-50057 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZC... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-47486 NVIDIA PhysX for all platforms contains a vulnerability where an attacker could... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-48379 Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111422 In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the va... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path throug... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-107672 A maliciously crafted .stack.json file can trigger a trusted Markdown injection... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-104349 Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulner... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-101834 Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101841 Vulnerability in the Global Order Promising product of Oracle E-Business Suite (... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101842 Vulnerability in the Strategic Network Optimization product of Oracle E-Business... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101852 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101853 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101854 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101557 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.