October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,458
Critical
3,286
High
7,915
Medium
7,613
Low
739
Severity not reported
4,905
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106334 Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-94063 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-89091 A flaw was found in ansible-core. |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83428 Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Busines... |
high | 8.1 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83481 Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (compon... |
high | 7.2 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Bod... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-78659 When "Trailer" headers are sent by a client, the HTTP server internally uses the... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-97031 Multiple ECH outer extension references are not permitted under RFC 9849; previo... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83429 Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Busines... |
high | 8.1 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83479 Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (compon... |
high | 8.8 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83438 Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (comp... |
high | 8.2 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83437 Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (comp... |
high | 7.7 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83451 Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite... |
high | 8.5 | — | Oracle / product workbench | 2026-09-15 | 2026-10-09 |
| CVE-2026-83432 Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (com... |
high | 8.1 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83435 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.2 | — | Oracle / bills of material | 2026-09-15 | 2026-10-09 |
| CVE-2026-83455 Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Busines... |
high | 8.1 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-104335 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-83456 Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Busines... |
high | 8.8 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-83457 Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Busines... |
high | 8.1 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-09 |
| CVE-2026-96333 Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94167 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94632 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95591 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94059 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-87742 A flaw was found in quarkus-websockets-next. |
high | 7.5 | — | — | 2026-09-17 | 2026-10-09 |
| CVE-2026-84271 IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypa... |
high | 7.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-09 |
| CVE-2026-81929 The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulner... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107724 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 7.4 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-107375 JHipster is a development platform to quickly generate, develop, and deploy mode... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105436 Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-ch... |
high | 8.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-105318 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-83447 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.1 | — | Oracle / bills of material | 2026-09-15 | 2026-10-09 |
| CVE-2026-83448 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.1 | — | Oracle / bills of material | 2026-09-15 | 2026-10-09 |
| CVE-2026-106403 Incorrect authorization in Accessibility in Google Chrome prior to 155.0.8059.39... |
high | 8.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-83449 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.5 | — | Oracle / bills of material | 2026-09-15 | 2026-10-09 |
| CVE-2026-83450 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.0 | — | Oracle / bills of material | 2026-09-15 | 2026-10-09 |
| CVE-2026-93548 The FooSales WordPress plugin before 1.43.3 does not verify that an authenticate... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-11930 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
high | 7.5 | — | Ibm / security verify access | 2026-10-08 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.