October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,692
Critical
3,236
High
7,698
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87897 A SSRF vulnerability found that enables access to internal Chrome Devtools Proto... |
medium | 4.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-16020 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105457 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104030 A flaw was found in sssd. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-05 | 2026-10-28 |
| CVE-2026-104031 A flaw was found in SSSD. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-28 |
| CVE-2026-104032 A flaw was found in SSSD. |
medium | 5.5 | — | Fedoraproject / sssd | 2026-10-06 | 2026-10-28 |
| CVE-2026-87097 Sensitive information disclosure due to insufficiently protected credentials. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87099 Cross-site scripting (XSS) vulnerability due to improper input validation. |
medium | 5.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87101 Sensitive information disclosure due to improper token validation. |
medium | 6.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87879 Sensitive information disclosure due to improper token validation. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-87360 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87361 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87362 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87354 Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Opera... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87345 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 6.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-87348 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.2 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-87350 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-87319 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 6.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87330 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87342 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 6.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-87344 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 6.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-114101 Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMedi... |
medium | 4.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114116 Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line t... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112950 Vitest is a Vite-native testing framework for JavaScript and TypeScript projects... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113650 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113659 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-63031 Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing... |
medium | 5.3 | — | — | 2025-12-31 | 2026-10-28 |
| CVE-2026-109088 A malicious X server could send malformed RECORD EnableContext reolies that can... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108301 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 6.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108302 Tanium addressed an improper access controls vulnerability in Comply. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108308 Tanium addressed a SQL injection vulnerability in Patch. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108309 Tanium addressed an uncontrolled resource consumption vulnerability in Performan... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108310 Tanium addressed a denial of service vulnerability in Tanium Server. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108313 Tanium addressed an incorrect privilege assignment vulnerability in Tanium Serve... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. |
medium | 4.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108325 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 6.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108326 Tanium addressed an improper certificate validation vulnerability in Stream Clie... |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108328 Tanium addressed an insertion of sensitive information into log file vulnerabili... |
medium | 4.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108332 Tanium addressed an improper link resolution before file access vulnerability in... |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116657 Tanium addressed a denial of service vulnerability in Enforce. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.