October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67074 HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116863 Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletter... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-48356 Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type... |
critical | 9.3 | Listed | Adobe / commerce | 2026-07-14 | 2026-10-28 |
| CVE-2026-87337 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-39746 Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-28 |
| CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-28 |
| CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114382 A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111809 Apache Traffic Server allows request smuggling via HEAD requests that carry Cont... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2024-51092 LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via O... |
critical | 9.1 | — | Librenms / librenms | 2026-05-08 | 2026-10-27 |
| CVE-2026-91656 Vulnerability in Oracle Essbase (component: Federated Partitions). |
critical | 9.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shar... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114108 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vul... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-112398 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2024-31026 An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allow... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-27 |
| CVE-2024-34320 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect acces... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-34323 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-4457 The Management Console fails to properly validate input related to the configura... |
critical | 9.1 | — | — | 2026-10-18 | 2026-10-27 |
| CVE-2026-105008 No cwe for this issue in Windows Schannel allows an unauthorized attacker to per... |
critical | 9.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-76473 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2024-11080 The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-05 | 2026-10-27 |
| CVE-2024-58309 xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allo... |
critical | 9.8 | — | Xbtitfm / xbtitfm | 2025-12-11 | 2026-10-27 |
| CVE-2024-14010 Typora 1.7.4 contains a command injection vulnerability in the PDF export prefer... |
critical | 9.8 | — | — | 2025-12-12 | 2026-10-27 |
| CVE-2024-57521 SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker... |
critical | 10.0 | — | Ruoyi / ruoyi | 2025-12-23 | 2026-10-27 |
| CVE-2024-44065 Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint... |
critical | 9.8 | — | Magicbug / cloudlog | 2025-12-26 | 2026-10-27 |
| CVE-2024-25181 A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allo... |
critical | 9.1 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-25182 givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. |
critical | 9.8 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-27480 givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. |
critical | 9.8 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-58351 Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri... |
critical | 9.8 | — | — | 2026-06-20 | 2026-10-27 |
| CVE-2024-51311 The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51313 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51312 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51314 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51315 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2026-101420 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
critical | 9.6 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authori... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-18450 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116504 A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.