October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,086
Critical
3,247
High
7,734
Medium
7,398
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (813), linux (709), ibm (323), oracle (191), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112860 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112862 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants D... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112853 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112857 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo a... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114607 Better Auth is an authentication and authorization library for TypeScript. |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-100886 A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4... |
critical | 10.0 | — | — | 2026-09-27 | 2026-10-23 |
| CVE-2026-104252 Vitess is a database clustering system for horizontal scaling of MySQL. |
critical | 9.8 | — | Linuxfoundation / vitess | 2026-10-13 | 2026-10-23 |
| CVE-2026-106486 Backstage is an open framework for building developer portals. |
critical | 9.9 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-bitbucket-cloud | 2026-10-06 | 2026-10-23 |
| CVE-2026-91637 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-94267 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
critical | 9.0 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2019-15598 A Code Injection exists in treekill on Windows which allows a remote code execut... |
critical | 9.8 | — | Tree-kill Project / tree-kill | 2019-12-18 | 2026-10-23 |
| CVE-2023-4548 A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. |
critical | 9.8 | — | Spa-cart / ecommerce cms | 2023-08-26 | 2026-10-23 |
| CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attack... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91299 Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111814 Apache Traffic Server's default outbound session-sharing policy can reuse a pool... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-75885 A flaw was found in the OpenShift console. |
critical | 9.3 | — | — | 2026-09-18 | 2026-10-23 |
| CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113678 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91305 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91665 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.8 | — | Oracle / essbase | 2026-10-20 | 2026-10-22 |
| CVE-2026-91265 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-76466 A vulnerability in the database service feature of Cisco Expressway Series could... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76474 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113270 Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a re... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113283 Memory corruption in CredentialProvider in Google Chrome on on Windows prior to... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113300 Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113328 Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113336 Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113342 Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113211 Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113222 Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote at... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113235 Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 a... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113252 Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113261 Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113263 Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 all... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113169 Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.