October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,087
Critical
3,247
High
7,734
Medium
7,399
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-76475 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2024-26011 A missing authentication for critical function vulnerability in Fortinet FortiMa... |
critical | 9.8 | — | Fortinet / fortios | 2024-11-12 | 2026-10-22 |
| CVE-2024-48884 A improper limitation of a pathname to a restricted directory ('path traversal')... |
critical | 9.1 | — | Fortinet / fortimanager | 2025-01-14 | 2026-10-22 |
| CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST par... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111704 LangChat through commit 2a6285a contains a missing authentication vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-101634 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91495 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91624 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101499 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101537 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101763 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101765 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101767 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101808 Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-60432 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-83396 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-83397 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-83399 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-87251 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91220 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91408 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-111832 Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111834 Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111852 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113020 Improper input validation in Date in Google Chrome prior to 156.0.8078.47 allowe... |
critical | 9.6 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113802 Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command inj... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101446 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101501 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101503 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101528 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101529 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-90042 In the Linux kernel, the following vulnerability has been resolved:
ceph: prope... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90036 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Preve... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-83888 Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal')... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-21 |
| CVE-2026-92262 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-21 |
| CVE-2026-44977 countly-server is the server-side part of Countly, a product analytics solution. |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.