October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,229
Critical
3,102
High
7,094
Medium
6,630
Low
674
Severity not reported
4,729
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-48282 Adobe ColdFusion Path Traversal Vulnerability |
critical | 10.0 | Listed | Adobe / ColdFusion | 2026-06-30 | 2026-10-25 |
| CVE-2026-13751 Improper handling of untrusted remote references in Snowflake CLI versions prior... |
critical | 9.6 | — | Snowflake / snowflake cli | 2026-06-29 | 2026-10-25 |
| CVE-2026-11720 A path traversal vulnerability exists in the HTTP tool URL builder of googleapis... |
critical | 9.1 | — | Google / mcp toolbox for databases | 2026-06-29 | 2026-10-25 |
| CVE-2026-14241 Memory safety bugs present in Firefox 152.0.3. |
critical | 9.8 | — | Mozilla / firefox | 2026-06-30 | 2026-10-25 |
| CVE-2026-10560 IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerabi... |
critical | 9.1 | — | Langflow / langflow | 2026-06-30 | 2026-10-25 |
| CVE-2026-11546 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected... |
critical | 9.8 | — | Ibm / websphere application server | 2026-06-30 | 2026-10-25 |
| CVE-2026-11714 IBM WebSphere Application Server Liberty is affected by a server-side request fo... |
critical | 9.8 | — | Ibm / websphere application server | 2026-06-30 | 2026-10-25 |
| CVE-2026-13449 IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable... |
critical | 9.1 | — | Ibm / business automation manager | 2026-06-30 | 2026-10-25 |
| CVE-2026-13772 IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language eng... |
critical | 9.9 | — | Ibm / websphere extreme scale | 2026-06-30 | 2026-10-25 |
| CVE-2026-13773 IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated C... |
critical | 10.0 | — | Ibm / websphere extreme scale | 2026-06-30 | 2026-10-25 |
| CVE-2026-7663 IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac... |
critical | 9.8 | — | Langflow / langflow | 2026-06-30 | 2026-10-25 |
| CVE-2026-11541 IBM CICS Transaction Gateway for Multiplatforms 9.1, 9.2, 9.3, and 10.1 IBM WebS... |
critical | 9.8 | — | Ibm / websphere application server | 2026-06-30 | 2026-10-25 |
| CVE-2026-54408 A malicious actor with access to the network could exploit an Improper Access Co... |
critical | 9.8 | — | Ui / unifi protect | 2026-07-02 | 2026-10-25 |
| CVE-2026-55115 A malicious actor with access to the network and low privileges could exploit a... |
critical | 9.9 | — | Ui / unifi protect | 2026-07-02 | 2026-10-25 |
| CVE-2026-59092 JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypas... |
critical | 9.8 | — | Juicedata / juicefs | 2026-07-02 | 2026-10-25 |
| CVE-2026-26145 Improper access control in Azure Synapse allows an authorized attacker to elevat... |
critical | 9.8 | — | Microsoft / azure synapse | 2026-07-02 | 2026-10-25 |
| CVE-2026-41106 Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un... |
critical | 9.3 | — | Microsoft / 365 copilot | 2026-07-02 | 2026-10-25 |
| CVE-2026-47898 Improper Restriction of XML External Entity Reference vulnerability in Apache Lu... |
critical | 9.8 | — | Apache / lucene.net | 2026-07-03 | 2026-10-25 |
| CVE-2026-13020 A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal... |
critical | 9.8 | — | Esri / portal for arcgis | 2026-07-07 | 2026-10-25 |
| CVE-2026-60002 ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its h... |
critical | 9.4 | — | Openbsd / openssh | 2026-07-08 | 2026-10-25 |
| CVE-2026-58480 Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthentic... |
critical | 9.8 | — | — | 2026-07-08 | 2026-10-25 |
| CVE-2026-3144 IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could a... |
critical | 9.8 | — | Ibm / api connect | 2026-07-08 | 2026-10-25 |
| CVE-2026-49869 Kestra OSS OS Command Injection Vulnerability |
critical | 10.0 | Listed | Kestra / Kestra OSS | 2026-06-26 | 2026-10-25 |
| CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability |
critical | 9.8 | Listed | Balbooa / Forms | 2026-07-09 | 2026-10-25 |
| CVE-2026-12411 Broken Access Control in the devLXDInstancePatchHandler component of Canonical L... |
critical | 9.6 | — | Canonical / lxd | 2026-06-26 | 2026-10-25 |
| CVE-2026-13775 Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13776 Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13780 Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13781 Insufficient validation of untrusted input in Skia in Google Chrome prior to 150... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13782 Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo... |
critical | 10.0 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-13785 Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14101 Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14104 Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr... |
critical | 9.8 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14106 Insufficient validation of untrusted input in Text in Google Chrome on Android p... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14109 Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-14120 Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47... |
critical | 9.6 | — | Google / chrome | 2026-06-30 | 2026-10-25 |
| CVE-2026-58025 Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWik... |
critical | 9.8 | — | Mediawiki / mediawiki | 2026-07-01 | 2026-10-25 |
| CVE-2026-58453 JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h... |
critical | 9.8 | — | — | 2026-07-01 | 2026-10-25 |
| CVE-2026-9074 IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains... |
critical | 9.8 | — | Ibm / api connect | 2026-07-08 | 2026-10-25 |
| CVE-2026-8649 Improper Neutralization of Special Elements in Data Query Logic vulnerability in... |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-08 | 2026-10-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.