October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98118 In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-116172 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116173 vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116176 vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerabili... |
high | 8.2 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116178 vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116179 vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. |
high | 7.7 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-115912 vLLM is an inference and serving engine for large language models. |
high | 8.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-65327 A logic issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-96521 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-28 |
| CVE-2026-86929 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-104189 The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for N... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116676 Atlantis is a self-hosted golang application that listens for Terraform pull req... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116682 FileBrowser Quantum is a free, self-hosted, web-based file manager. |
high | 8.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112355 The MembershipWorks plugin for WordPress before 6.17 contains an information dis... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-104016 ProtobufParser parses length-prefixed protobuf string and bytes fields by checki... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104895 The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary len... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110747 ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry'... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117607 Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerabil... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118377 mews/pos through 2.0.0 contains an insufficient verification of data authenticit... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118485 Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-52729 Xibo is an open source digital signage platform with a web content management sy... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59177 ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-63286 Database backups are vulnerable to offline attacks. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buff... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Or... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocN... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102636 A maliciously crafted HTML payload in a design name, when displayed after anothe... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102637 A maliciously crafted HTML payload in the documentName parameter of a Fusion pro... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-102638 A maliciously crafted HTML payload in the description of an electronic library (... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116688 CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2013-20007 Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability t... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2015-20129 CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that a... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118375 llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in t... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-6064 Link following vulnerability in Data Shredder components in Norton Antivirus, Av... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87394 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87397 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87364 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.