October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,316
Critical
3,226
High
7,610
Medium
7,220
Low
656
Severity not reported
4,604
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96380 Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
medium | 4.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96385 Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96386 Missing Authorization vulnerability in Drupal Smart Content allows Forceful Brow... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat ap... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96390 Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Access... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-96398 Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115334 Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUse... |
medium | 6.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113719 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-98123 In the Linux kernel, the following vulnerability has been resolved:
sctp: fix s... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-98124 In the Linux kernel, the following vulnerability has been resolved:
smb/client:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-98125 In the Linux kernel, the following vulnerability has been resolved:
smb/client:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-87955 Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forcef... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114479 Not failing securely in the anti-virus attachment-stripping action of Progressiv... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-23706 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-114092 Trigger.dev before 4.5.0 performs no authentication or organization check in the... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101800 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101806 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101812 Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101814 Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (comp... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101795 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101745 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101723 Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Ch... |
medium | 6.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101716 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101696 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-98126 In the Linux kernel, the following vulnerability has been resolved:
smb/client:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-98127 In the Linux kernel, the following vulnerability has been resolved:
smb/client:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-113054 Out of bounds read in SiteIsolation in Google Chrome prior to 156.0.8078.47 allo... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113047 Memory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113050 Out of bounds read in HID in Google Chrome prior to 156.0.8078.47 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113051 Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remot... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113102 Out of bounds read in FileSystem in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113151 Out of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113178 Memory corruption in Views in Google Chrome on on Mac prior to 156.0.8078.47 all... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-17557 A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift A... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113159 Improper access control in DevTools in Google Chrome prior to 156.0.8078.47 allo... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113193 Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113199 Out of bounds read in Payments in Google Chrome prior to 156.0.8078.47 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113201 Memory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.