October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,594
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112770 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code executi... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-85197 A flaw was found in libsoup. |
high | 7.6 | — | — | 2026-09-04 | 2026-10-22 |
| CVE-2026-91349 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91350 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-87369 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-87395 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-87398 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91254 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91255 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91344 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91345 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-82814 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-115482 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115353 Mistune before 3.3.0 contains a path traversal vulnerability in the RST include... |
high | 8.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114219 NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114052 vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability i... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113872 multer is a middleware for Node.js that handles multipart/form-data file uploads... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-101810 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111181 body-parser is body parsing middleware for Node.js and Express. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-101572 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101679 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101508 Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101520 Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework pr... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-96912 Use after free in Windows Client License Service allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96911 Improper link resolution before file access ('link following') in Microsoft Wind... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96914 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) En... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96913 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-83661 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-93905 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allo... |
high | 8.2 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in creat... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows pub... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101830 Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101815 Vulnerability in the Assets product of Oracle E-Business Suite (component: Inter... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101818 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101822 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101785 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101769 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster:... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101735 Vulnerability in the Primavera Unifier product of Oracle Construction and Engine... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.