October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,689
Critical
3,236
High
7,696
Medium
7,353
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11592 The Email Subscribers & Newsletters – Email Marketing, Post Notifications & News... |
medium | 4.3 | — | — | 2026-07-02 | 2026-10-28 |
| CVE-2026-114252 A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c4... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2024-21970 Improper validation of an array index in the AND power Management Firmware could... |
medium | 4.4 | — | — | 2025-09-06 | 2026-10-27 |
| CVE-2024-47569 A insertion of sensitive information into sent data vulnerability in Fortinet Fo... |
medium | 4.3 | — | Fortinet / fortimail | 2025-10-14 | 2026-10-27 |
| CVE-2024-58335 OpenXRechnungToolbox through 2024-10-05-3.0.0 before 6c50e89 allows XXE because... |
medium | 5.0 | — | — | 2025-12-24 | 2026-10-27 |
| CVE-2024-58379 nodemailer before 6.9.9 contains a regular expression denial of service vulnerab... |
medium | 5.3 | — | — | 2026-08-31 | 2026-10-27 |
| CVE-2026-91657 Vulnerability in Oracle Essbase (component: Security). |
medium | 4.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91660 Vulnerability in Oracle Essbase (component: Security). |
medium | 4.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91662 Vulnerability in Oracle Essbase (component: Java Based Agent). |
medium | 6.4 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-114103 adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attack... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114058 ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114073 Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability th... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114088 Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in th... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114093 Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability tha... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113737 A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f279... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114043 FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipbo... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-113743 A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2021-48019 Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forward... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2020-37286 Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability cause... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-76281 As part of Cisco's ongoing commitment to proactive security and product quality,... |
medium | — | — | Splunk / splunk | 2026-10-07 | 2026-10-27 |
| CVE-2026-112906 filelock is a platform-independent file lock for Python. |
medium | 4.7 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-112909 filelock is a platform-independent file lock for Python. |
medium | 6.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-27 |
| CVE-2026-19621 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 6.5 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-19600 Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-19076 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
medium | 4.9 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-27 |
| CVE-2026-106456 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-proxy-backend | 2026-10-06 | 2026-10-27 |
| CVE-2026-106458 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/plugin-catalog-backend-module-bitbucket-server | 2026-10-06 | 2026-10-27 |
| CVE-2026-106460 Backstage is an open framework for building developer portals. |
medium | 6.8 | — | Linuxfoundation / backstage\/plugin-auth-node | 2026-10-06 | 2026-10-27 |
| CVE-2026-83794 Out-of-bounds read in Windows Portable Device MTP Driver allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83798 Improper verification of cryptographic signature in Windows Update Stack allows... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-87303 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87290 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87298 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87299 Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middlewar... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83835 Buffer over-read in Windows Common Log File System Driver allows an authorized a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-107324 An integer overflow in BSON value-length handling in the MongoDB Go Driver can c... |
medium | 5.9 | — | Mongodb / go driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-107325 Improper validation of a BSON array length in the MongoDB Go Driver can cause an... |
medium | 5.9 | — | Mongodb / go driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-87291 Vulnerability in Oracle Java SE (component: Networking). |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87293 Vulnerability in Oracle Java SE (component: RMI). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.