October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91488 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 7.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-114635 Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerabil... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-91653 Vulnerability in Oracle Essbase (component: Essbase Web Platform). |
high | 8.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-83366 Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83370 Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auc... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-7025 A vulnerability was found in Typecho up to 1.3.0. |
high | 7.3 | — | — | 2026-04-26 | 2026-10-27 |
| CVE-2026-113728 Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos b... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-116191 Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav tha... |
high | 7.5 | — | Rclone / rclone | 2026-10-25 | 2026-10-27 |
| CVE-2026-15723 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1... |
high | 8.2 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-102231 Improper resolution of path equivalence in Visual Studio Code allows an unauthor... |
high | 7.7 | — | Microsoft / visual studio code | 2026-10-13 | 2026-10-27 |
| CVE-2026-91636 Vulnerability in Oracle Essbase (component: Security). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91639 Vulnerability in Oracle Essbase (component: Security). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91642 Vulnerability in Oracle Essbase (component: Security). |
high | 7.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-83367 Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-47025 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-60662 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-76234 libcrux-ecdh and libcrux-ed25519 before 0.0.6, and libcrux-psq before 0.0.7, con... |
high | 7.5 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-16817 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c... |
high | 7.5 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-16818 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c... |
high | 7.5 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-44829 Gotenberg is a Docker-powered stateless API for PDF files. |
high | 8.8 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-45741 Gotenberg is a Docker-powered stateless API for PDF files. |
high | 7.5 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-45742 Gotenberg is a Docker-powered stateless API for PDF files. |
high | 7.5 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-49253 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft... |
high | 7.1 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-49255 electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ft... |
high | 8.8 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-52834 jxl-oxide is a pure Rust implementation of a JPEG XL decoder. |
high | 7.3 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-63937 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: U... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63927 In the Linux kernel, the following vulnerability has been resolved:
usb: dwc2:... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63925 In the Linux kernel, the following vulnerability has been resolved:
macsec: fix... |
high | 8.1 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63923 In the Linux kernel, the following vulnerability has been resolved:
octeontx2-a... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63921 In the Linux kernel, the following vulnerability has been resolved:
ip6: vti: U... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63920 In the Linux kernel, the following vulnerability has been resolved:
ipv6: valid... |
high | 7.1 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-63919 In the Linux kernel, the following vulnerability has been resolved:
xfrm: input... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-86950 Apple Multiple Products Out-of-Bounds Write Vulnerability |
high | 8.8 | Listed | Apple / Multiple Products | 2026-09-28 | 2026-10-27 |
| CVE-2026-113729 Moov signedxml is a pure Go library for processing signed XML documents. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-101851 Vulnerability in the Installed Base product of Oracle E-Business Suite (componen... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-101849 Vulnerability in the Installed Base product of Oracle E-Business Suite (componen... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.