October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,426
Critical
3,227
High
7,633
Medium
7,252
Low
684
Severity not reported
4,630
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14511 IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a deni... |
medium | 6.5 | — | Ibm / mq | 2026-10-19 | 2026-10-23 |
| CVE-2026-115370 Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115378 Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbit... |
medium | 5.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114623 baserCMS is a website development framework. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2012-20003 Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-55862 pupnp is an SDK for development of UPnP device and control point applications. |
medium | 6.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-112821 Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploit... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112825 Missing Authorization vulnerability in Magepeople inc. |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-107674 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Cer... |
medium | 4.4 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17073 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive in... |
medium | 5.5 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17275 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthoriz... |
medium | 5.3 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17488 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypa... |
medium | 6.5 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-17491 IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to b... |
medium | 5.4 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-11828 IBM MQ could allow a remote attacker with queue manager control or man-in-the-mi... |
medium | 5.9 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-76303 In Splunk SOAR versions below 8.7.0, a user that holds a role with the install_a... |
medium | 5.7 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-115382 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial-of-serv... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115390 Wasmtime 47.0.0 before 48.0.3 and 49.0.0 before 49.0.1 contains a fuel accountin... |
medium | 5.7 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115329 Lotus through 0.10.2 contains an insecure direct object reference vulnerability... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115333 Lotus through 0.10.2 contains an improper authentication vulnerability in the Go... |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115356 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not verify, when renewing a tok... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114634 WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerabi... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114659 Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass be... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115321 Bytebase before 3.16.0 contains an authorization bypass vulnerability in the Upd... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114492 gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114515 OCO-Server is a self-hosted endpoint management application for computer invento... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113800 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114128 Astro is a web framework for content-driven websites. |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114361 A vulnerability was detected in HarnessRouter up to 0.31.10. |
medium | 5.6 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111668 AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/ap... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-113796 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 4.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-112333 GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability i... |
medium | 5.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106461 Backstage is an open framework for building developer portals. |
medium | 4.3 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-23 |
| CVE-2026-93682 When the HTTP stream wrapper follows a redirect and the response carries a Locat... |
medium | 5.8 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2025-14181 The SOAP HTTP client guards its response buffer growth with a check that relies... |
medium | 6.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2025-1218 The mysqlnd wire protocol parser reads fields out of server packets before check... |
medium | 5.9 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-115361 OpenBao before 2.6.3 contains an ACL bypass vulnerability that silently drops ex... |
medium | 4.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115365 OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerabilit... |
medium | 6.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-109933 The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and es... |
medium | 6.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109934 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whet... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111738 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level... |
medium | 5.5 | — | — | 2026-10-23 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.