October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,086
Critical
3,247
High
7,734
Medium
7,398
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (813), linux (709), ibm (323), oracle (191), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12118 IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated... |
critical | 9.8 | — | Ibm / webmethods integration | 2026-07-30 | 2026-10-23 |
| CVE-2026-66756 Improper Protection of Alternate Path vulnerability in Apache Tika. |
critical | 9.8 | — | Apache / tika | 2026-07-30 | 2026-10-23 |
| CVE-2026-67208 Juggle through 1.6.0 contains a remote code execution vulnerability that allows... |
critical | 9.8 | — | — | 2026-07-30 | 2026-10-23 |
| CVE-2026-18602 A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-41452 Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installe... |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-18614 A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-68979 Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API me... |
critical | 9.8 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-68980 Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets... |
critical | 9.1 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-10025 IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 00... |
critical | 9.8 | — | Ibm / qradar security information and event manager | 2026-08-05 | 2026-10-23 |
| CVE-2026-17617 IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side... |
critical | 9.8 | — | Ibm / application gateway operator | 2026-08-05 | 2026-10-23 |
| CVE-2026-17556 A path traversal vulnerability was identified in GitHub Enterprise Server that a... |
critical | 9.1 | — | Github / enterprise server | 2026-08-05 | 2026-10-23 |
| CVE-2026-18847 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ha... |
critical | 9.8 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-63244 An authentication
bypass vulnerability in WizLearn Technologies' Learning Manage... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-25784 Initialization of a Resource with an Insecure Default vulnerability in Hallo Wel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-55981 A firmware verification vulnerability in Creative Sound
Blaster Katana could all... |
critical | 9.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-53942 Conda Organization Infrastructure is a centralized location for infrastructure c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115812 Relative path traversal during model archive extraction in Amazon Web Services M... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109219 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in ve... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-13737 CommServe contained an allowlist bypass vulnerability affecting command executio... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
| CVE-2026-13738 CommServe contained an authorization bypass vulnerability affecting a limited se... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
| CVE-2026-13739 A legacy endpoint in Command Center contained an unauthenticated server-side req... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
| CVE-2026-16860 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec... |
critical | 9.9 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-17276 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to esca... |
critical | 9.9 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-17111 IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. |
critical | 9.8 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-10543 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil... |
critical | 9.8 | — | Ibm / db2 | 2026-08-12 | 2026-10-23 |
| CVE-2026-13433 IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to do... |
critical | 9.6 | — | Ibm / i access client solutions | 2026-08-12 | 2026-10-23 |
| CVE-2026-10534 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer... |
critical | 9.8 | — | Ibm / db2 | 2026-08-12 | 2026-10-23 |
| CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu... |
critical | 9.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-91638 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91658 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91663 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-111643 Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulner... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115547 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows... |
critical | 9.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-46652 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.