October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112391 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-23 |
| CVE-2026-115486 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115546 Okta Access Gateway (OAG) does not validate the selected authentication source d... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111663 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20104 EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path tra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-57486 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57487 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-112359 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112837 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-102917 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevatin... |
high | 7.8 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or cor... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-57121 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-57113 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115723 Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115727 AgenticSeek before commit 409840c contains a remote code execution vulnerability... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted defau... |
high | 8.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115325 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the upd... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114137 Django REST framework is a toolkit for building Web APIs. |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114145 GitPython is a python library used to interact with Git repositories. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-110744 A flaw was found in multicluster-global-hub-operator-bundle. |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111079 A flaw was found in Goose. |
high | 7.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-104068 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2021-48018 Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentr... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-91651 Vulnerability in Oracle Essbase (component: Essbase Web Platform). |
high | 8.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-17545 On Windows, PHP's filesystem and stream APIs do not reject reserved device names... |
high | 7.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-109198 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115497 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109936 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a patter... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111982 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a us... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113499 The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its H... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113500 The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.