October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the curre... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending pass... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly deter... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not e... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85683 The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonc... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106573 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-111833 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-112221 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-78409 The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later... |
high | 7.0 | — | — | 2026-09-02 | 2026-10-21 |
| CVE-2026-101469 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101460 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101461 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101463 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101467 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113021 Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113024 Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113025 Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113027 Memory corruption in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113028 Use after free in Media in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113012 Improper input validation in GPU in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113029 Improper access control in ANGLE in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-112993 Use after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-112996 Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113013 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113008 Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113015 Use after free in Workers in Google Chrome prior to 156.0.8078.47 allowed a remo... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113016 Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113017 Use after free in Views in Google Chrome prior to 156.0.8078.47 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113011 Use after free in CredentialProvider in Google Chrome on on Windows prior to 156... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113090 Memory corruption in Interstitials in Google Chrome prior to 156.0.8078.47 allow... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113093 Memory corruption in DisplayLocking in Google Chrome prior to 156.0.8078.47 allo... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113094 Memory corruption in API in Google Chrome prior to 156.0.8078.47 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113095 Out of bounds read in Focus in Google Chrome prior to 156.0.8078.47 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113097 Use after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.