October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,692
Critical
3,236
High
7,698
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50541 Xibo is an open source digital signage platform with a web content management sy... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-16491 Grafana’s RBAC service ignored the requested folder when checking whether a user... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language mode... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2013-20009 Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerabi... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87396 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87387 Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD E... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87388 Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87390 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87391 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87392 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87393 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87382 Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Or... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87383 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87384 Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87385 Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87386 Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle J... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87377 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87378 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87379 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87380 Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracl... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87381 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87374 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87375 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87376 Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middlew... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87370 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87371 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87372 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87365 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87366 Vulnerability in the Oracle Applications Framework product of Oracle E-Business... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-114091 Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$r... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113707 A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113738 A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to e... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112935 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2020-37287 Vyper before 0.2.6 contains a call stack corruption vulnerability that causes in... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-63569 Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Dif... |
medium | 6.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-77172 App passwords were allowed to bypass password confirmation on sensitive endpoint... |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-77173 A user could create a docx or odt file with a # in the filename with confidentia... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82984 When a team was configured as "visible to everyone", the web UI correctly blocke... |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82986 The user in a group can bypass the group restriction set by an administrator on... |
medium | 4.6 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.