October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,341
Critical
3,226
High
7,610
Medium
7,230
Low
656
Severity not reported
4,619
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114042 FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel th... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114047 FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vul... |
medium | 6.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114057 ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-10841 IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Serv... |
medium | 4.8 | — | — | 2026-09-18 | 2026-10-22 |
| CVE-2026-101569 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101581 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101587 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101695 Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101720 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101359 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101394 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101399 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-106462 Backstage is an open framework for building developer portals. |
medium | 6.4 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-106463 Backstage is an open framework for building developer portals. |
medium | 5.4 | — | Linuxfoundation / backstage\/plugin-catalog-backend-module-gitlab | 2026-10-06 | 2026-10-22 |
| CVE-2026-106487 Backstage is an open framework for building developer portals. |
medium | 5.0 | — | Linuxfoundation / backstage\/plugin-kubernetes-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-84924 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87936 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87937 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Cent... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87939 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87940 Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupa... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87942 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84915 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84917 Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Force... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84919 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84921 Missing Authorization vulnerability in Drupal Webform Submissions Delete allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84923 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84914 Missing Authorization vulnerability in Drupal Calculate Working Days allows Forc... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114062 SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114067 Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114072 The Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulne... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101828 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101807 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101819 Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101821 Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101793 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101794 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101798 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101799 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101801 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.9 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.