October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,039
Critical
3,131
High
7,102
Medium
6,936
Low
617
Severity not reported
4,253
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-12660 IBM MQ Web Console could allow an authenticated administrator to write files out... |
low | 2.7 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-111648 BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerabil... |
low | 2.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-115449 A flaw was found in libslirp. |
low | 3.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111658 SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in... |
low | 3.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-17068 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version... |
low | 3.3 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-115386 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
low | 2.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attacker... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114124 Electron is a framework for writing cross-platform desktop applications using Ja... |
low | 3.9 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111678 Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8... |
low | 3.3 | — | Antiword Project / antiword | 2026-10-16 | 2026-10-23 |
| CVE-2026-110510 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not valida... |
low | 3.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-110537 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify... |
low | 3.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111737 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape so... |
low | 3.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112230 The Popup Builder WordPress plugin before 4.4.6 does not perform authorization c... |
low | 3.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113501 The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability... |
low | 3.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-6103 phar_tar_number() parses the octal size field of a TAR header into a uint32_t wi... |
low | 3.3 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-101404 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
low | 3.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91397 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
low | 3.6 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101397 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
low | 2.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101400 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
low | 2.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101401 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
low | 2.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101402 Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (compo... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113596 Webstudio before 0.256.0 contains a missing authorization vulnerability that all... |
low | 3.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113648 ApostropheCMS is an open-source Node.js content management system. |
low | 3.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-112193 A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. |
low | 3.7 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112249 A vulnerability was detected in grandnode grandnode2 up to 2.3.0. |
low | 2.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-84916 Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84918 Improper Verification of Cryptographic Signature vulnerability in Drupal Monoban... |
low | 3.7 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-16648 Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-101804 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec... |
low | 2.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101805 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Su... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101790 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101738 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
low | 3.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101740 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
low | 3.6 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2020-37288 Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-21812 HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensi... |
low | 2.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87948 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87949 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Ser... |
low | 3.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-84911 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripti... |
low | 3.1 | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.