October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91449 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91450 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91448 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91447 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-106110 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106112 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106113 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106115 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-114263 A vulnerability was identified in ProjectWorlds Advanced Library Management Syst... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114254 A vulnerability was identified in oretnom23 file-management-system-php up to 2e3... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114257 A security vulnerability has been detected in oretnom23 file-management-system-p... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-79976 The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78118 The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a t... |
high | 7.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-75507 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-19676 The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114441 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111804 Apache Traffic Server's experimental wasm plugin has a use-after-free in its tra... |
high | 8.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111805 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111808 Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool vi... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111810 Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-109290 Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vuln... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2019-25778 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2022-51021 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticat... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-18556 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulner... |
high | 7.4 | Listed | N-able / N-central | 2026-08-01 | 2026-10-23 |
| CVE-2026-18577 N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulner... |
high | 8.1 | Listed | N-able / N-central | 2026-08-02 | 2026-10-23 |
| CVE-2025-57739 An improper neutralization of special elements used in an SQL Command ("SQL Inje... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-23 |
| CVE-2025-71433 Kaneo before 2.1.6 contains a missing authorization vulnerability that allows au... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-23 |
| CVE-2026-91442 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91445 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91433 Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (c... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91437 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91438 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91415 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91419 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-56833 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-56837 PraisonAI is a multi-agent teams system. |
high | 8.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115352 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115506 libexpat through 2.9.0 contains a denial of service vulnerability because billio... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115570 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.