October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,594
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101689 Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-106565 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-106567 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-95635 Photoshop Desktop is affected by a Double Free vulnerability that could result i... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95636 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95637 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95638 Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95639 Photoshop Desktop is affected by an Incorrect Authorization vulnerability that c... |
high | 8.6 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path trave... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-114107 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114391 ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonM... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2019-25779 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows u... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115416 Incorrect authorization checks in Amazon Athena engine version 3 query processin... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vul... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerabil... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-95641 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95696 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
high | 7.5 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-113779 The pfSense REST API package is an unofficial, open-source REST and GraphQL API... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-98122 In the Linux kernel, the following vulnerability has been resolved:
vxlan: mdb:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-97237 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-10-22 |
| CVE-2026-76066 IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-115513 OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-76306 In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could u... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Web... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115330 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-114097 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in Comm... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unau... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101820 Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101823 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101825 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101826 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101827 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101829 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101797 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101816 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101791 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.