October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114261 A vulnerability was found in MomoTommy file-management-system dc9ce1bf27f94b23d9... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114135 Jupyter Server is the backend for Jupyter web applications. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-92925 A flaw was found in Redis community. |
high | 7.1 | — | — | 2026-09-17 | 2026-10-28 |
| CVE-2026-5821 The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletio... |
high | 8.1 | — | — | 2026-07-02 | 2026-10-28 |
| CVE-2026-114387 Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability t... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114242 A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114249 A vulnerability was detected in dhikshitha29 Insurance-Management-System 91de5ed... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2024-58383 Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pur... |
high | 7.3 | — | — | 2026-09-14 | 2026-10-27 |
| CVE-2024-58400 llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_dec... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2024-50571 A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 throu... |
high | 7.2 | — | Fortinet / fortianalyzer | 2025-10-14 | 2026-10-27 |
| CVE-2024-46508 yeti-platform yeti before 2.1.12 allows attackers to generate valid JWT tokens i... |
high | 7.5 | — | Yeti-platform / yeti | 2026-05-08 | 2026-10-27 |
| CVE-2024-53326 LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LI... |
high | 7.3 | — | — | 2026-05-08 | 2026-10-27 |
| CVE-2026-96442 A code execution flaw was found in Emacs, affecting versions prior to 31.2. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-27 |
| CVE-2026-91659 Vulnerability in Oracle Essbase (component: Build). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91661 Vulnerability in Oracle Essbase (component: Security). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91668 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-6893 A flaw was found in dracut. |
high | 7.5 | — | — | 2026-06-10 | 2026-10-27 |
| CVE-2026-114098 Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stas... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114063 SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vul... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114068 Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the w... |
high | 8.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in Delet... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-114053 vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-111379 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-27 |
| CVE-2026-112402 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112401 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112400 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112397 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-106457 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-cloudflare-access-provider | 2026-10-06 | 2026-10-27 |
| CVE-2026-83795 Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attac... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83796 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83797 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-27 |
| CVE-2026-106433 Improper state management in MongoDB libmongocrypt can cause provider-specific d... |
high | 8.8 | — | Mongodb / libmongocrypt | 2026-10-08 | 2026-10-27 |
| CVE-2026-87304 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87305 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87306 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87307 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87308 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87300 Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusi... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.