October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,478
Critical
3,229
High
7,648
Medium
7,275
Low
690
Severity not reported
4,636
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86517 A flaw has been found in itsourcecode Sales and Inventory System 1.0. |
medium | 6.3 | — | — | 2026-09-08 | 2026-10-24 |
| CVE-2025-27895 IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27896 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27902 IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link wit... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-27897 IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cr... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-24 |
| CVE-2025-71435 Coder before 2.23.0 contains a session expiration bypass vulnerability that allo... |
medium | 4.2 | — | — | 2026-10-17 | 2026-10-24 |
| CVE-2026-66384 JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vu... |
medium | 5.3 | Listed | JFrog / Artifactory | 2026-08-12 | 2026-10-24 |
| CVE-2026-109935 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibi... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability |
medium | 5.3 | Listed | Cisco / Secure Firewall Management Center (FMC) | 2026-07-29 | 2026-10-24 |
| CVE-2026-91487 Vulnerability in Oracle Java SE (component: Compiler). |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91480 Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Ora... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91481 Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle Peop... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91482 Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Ora... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91486 Vulnerability in the PeopleSoft Enterprise FIN General Ledger Brazil product of... |
medium | 4.4 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91475 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
medium | 6.6 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91479 Vulnerability in the RDBMS component of Oracle Database Server. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91462 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91463 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91464 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91467 Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion M... |
medium | 6.6 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91455 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-106111 ImageSharp is a 2D graphics library. |
medium | 5.3 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106114 ImageSharp is a 2D graphics library. |
medium | 5.3 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-106116 ImageSharp is a 2D graphics library. |
medium | 5.3 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-24 |
| CVE-2026-114260 A vulnerability has been found in oretnom23 file-management-system-php up to 2e3... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78116 The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO subm... |
medium | 5.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78117 The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6... |
medium | 4.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-78119 The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-19947 The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114508 Laravel is a web application framework. |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-115247 A security vulnerability has been detected in subhajitkhan online-clinic-managem... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114266 A security vulnerability has been detected in ProjectWorlds Advanced Library Man... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111817 Apache Traffic Server can stall a chunked transfer that it passes through with i... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-112381 Apache Traffic Server can crash with a null pointer dereference when a client PO... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114375 A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114378 A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114381 A vulnerability was determined in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114384 A security vulnerability has been detected in itsourcecode Online Cake Ordering... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-109299 Open WebUI from 0.9.0 before 0.11.4 contains a denial of service vulnerability t... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
| CVE-2026-109294 Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumpti... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.