October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,594
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94268 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113682 Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level wi... |
high | 7.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-112995 Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113022 Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-112994 Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-92183 GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnera... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92208 NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92209 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76587 IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overfl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-82891 IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obt... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-87351 Vulnerability in Oracle GoldenGate (component: Admin Server Executable). |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111184 NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-105949 Cruise Control's Jetty ConstraintSecurityHandler registers security constraints... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101481 Vulnerability in Oracle Secure Backup (component: Device Management and Support)... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101482 Vulnerability in Oracle Secure Backup (component: Device Management and Support)... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-39769 Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-23 |
| CVE-2026-75887 A flaw was found in the OpenShift console. |
high | 7.5 | — | — | 2026-09-23 | 2026-10-23 |
| CVE-2026-108334 A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant op... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-91478 Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Ora... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113727 OpenChoreo is a developer platform for Kubernetes. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101398 Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-96251 Reliance on untrusted inputs in a security decision in Microsoft PowerShell allo... |
high | 8.8 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-93888 IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-76478 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76479 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76494 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76495 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76496 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.0 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76476 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76477 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20291 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113331 Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113146 Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 all... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113147 Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.