October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,341
Critical
3,226
High
7,610
Medium
7,230
Low
656
Severity not reported
4,619
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114100 Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114110 Astral uv before 0.11.6 contains a path traversal vulnerability that allows atta... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114120 SchedulePress before 5.3.5 contains a missing authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114386 Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit... |
medium | 4.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114404 PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in... |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-115322 Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTask... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113866 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also quer... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113868 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not che... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. |
medium | 5.6 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-98121 In the Linux kernel, the following vulnerability has been resolved:
watchdog: m... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-107692 The War Thunder game client transmits its authentication bearer token (auth_jwt)... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-87950 Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provide... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87943 Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provi... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87945 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provide... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87947 Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SS... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-93856 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occ... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114117 Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.v... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-84910 Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Br... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84912 Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allow... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84913 Missing Authorization vulnerability in Drupal AI Translate allows Forceful Brows... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87954 Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forc... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96356 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96357 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96358 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96359 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96366 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96367 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96370 Incorrect Authorization vulnerability in Drupal Webform allows Server Side Reque... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96371 Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Sto... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96372 Insufficient Granularity of Access Control vulnerability in Drupal Webform allow... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows... |
medium | 4.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary i... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Com... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes v... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.