October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76105 Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of In... |
high | 7.1 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-108116 In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter... |
high | 7.5 | — | Progress / kendo ui | 2026-10-15 | 2026-10-20 |
| CVE-2026-57488 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.1 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-77630 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111090 A logic error exists in the signature verification routine resulting in acceptan... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113469 A failure has been identified in the SNS during dynamic data files signature che... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113808 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113810 A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. |
high | 7.0 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-108089 ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an u... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75996 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-113404 WebITR developed by Uniong has a Insecure Deserialization vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113407 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112301 A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112360 A security vulnerability has been detected in Netis EAP930 1.250905.115454. |
high | 8.0 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-93300 The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injec... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113381 A weakness has been identified in Osclass up to 8.3.1. |
high | 7.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113392 A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113395 A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113396 A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113397 A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112836 Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentca... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94450 Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 a... |
high | 7.5 | — | — | 2026-09-22 | 2026-10-20 |
| CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) fo... |
high | 7.2 | — | — | 2026-09-14 | 2026-10-20 |
| CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in... |
high | 8.7 | — | — | 2026-09-16 | 2026-10-20 |
| CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's r... |
high | 8.4 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-69076 Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69077 Exposure of unauthorized cross-project job manipulation vulnerability in Apache... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69080 Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kyli... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. |
high | 8.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110752 Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying th... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109588 Numeric truncation of the buffer length in the MPU buffer authorization check in... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-108984 A vulnerability is in Web Server default connection ports under the process name... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-104679 VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML externa... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-102204 Improper link resolution before file access ('link following') in Windows Subsys... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-34633 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-34634 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-71385 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.4 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.