October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,064
Critical
3,133
High
7,120
Medium
6,940
Low
617
Severity not reported
4,254
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105612 PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypas... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105615 PostgreSQL's optimized statistics on a table are visible as long as you have SEL... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118608 Alpine iLX-F511 libanwbtstack.so prh_rfcomm_cc_process_test Out-Of-Bounds Read I... |
low | 3.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2024-3586 The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some... |
low | 3.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105258 The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape sev... |
low | 3.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108685 The WP Post Author WordPress plugin before 4.2.0 does not check that the account... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-108686 The WP Post Author WordPress plugin before 4.2.0 does not restrict the integrati... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85007 The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a ca... |
low | 3.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115303 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/L... |
low | 3.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-77564 Talos Linux is a Linux distribution built for Kubernetes deployments. |
low | 3.3 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-115797 A weakness has been identified in Tenda F6 12.02.01.73. |
low | 3.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-114614 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
low | 3.5 | — | Authlib / authlib | 2026-10-22 | 2026-10-29 |
| CVE-2026-115730 i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that a... |
low | 3.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-91400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
low | 3.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-115389 Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not... |
low | 2.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115393 Wasmtime before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115359 OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit qu... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclo... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_ci... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115319 fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnera... |
low | 2.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115246 A weakness has been identified in subhajitkhan online-clinic-management-system u... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115535 A vulnerability was identified in gedelumbung HospitalManagement up to c2d455437... |
low | 2.4 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115358 OpenBao before 2.6.3 contains an information disclosure vulnerability that allow... |
low | 2.0 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115362 OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-90721 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
low | 3.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103394 An Improper Initialization vulnerability in the SSR software in Juniper Networks... |
low | 3.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-101570 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91264 Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle P... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91249 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Librar... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-58616 Concurrent execution using shared resource with improper synchronization ('race... |
low | 3.0 | — | Microsoft / edge chromium | 2026-08-28 | 2026-10-28 |
| CVE-2026-101425 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
low | 2.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-91322 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-114641 Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in... |
low | 3.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114377 A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.... |
low | 3.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2023-0785 A vulnerability classified as problematic was found in SourceCodester Best Onlin... |
low | 3.7 | — | Mayurik / best online news portal | 2023-02-12 | 2026-10-28 |
| CVE-2023-23697 Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitra... |
low | 3.3 | — | Dell / command \| intel vpro out of band | 2023-02-13 | 2026-10-28 |
| CVE-2026-91334 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91335 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
low | 2.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91330 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91331 Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product... |
low | 3.8 | — | — | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.