October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,416
Critical
3,281
High
7,882
Medium
7,582
Low
740
Severity not reported
4,931
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-14141 A flaw has been found in UTT 进取 520W 1.7.7-180627. |
critical | 9.8 | — | Utt / 520w firmware | 2025-12-06 | 2026-10-15 |
| CVE-2026-110958 A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-83038 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.9 | — | Oracle / weblogic server | 2026-09-15 | 2026-10-15 |
| CVE-2025-14245 A vulnerability has been found in IdeaCMS up to 1.8. |
critical | 9.8 | — | Ideacms / ideacms | 2025-12-08 | 2026-10-15 |
| CVE-2025-61318 Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. |
critical | 9.1 | — | Emlog / emlog | 2025-12-08 | 2026-10-15 |
| CVE-2025-14306 A directory traversal vulnerability exists in the CacheCleaner component of Robo... |
critical | 9.1 | — | Robocode / robocode | 2025-12-09 | 2026-10-15 |
| CVE-2025-14308 An integer overflow vulnerability exists in the write method of the Buffer class... |
critical | 9.8 | — | Robocode / robocode | 2025-12-09 | 2026-10-15 |
| CVE-2026-59318 In Spring AI's tool calling support, the per-request tool list is advertised to... |
critical | 9.8 | — | Vmware / spring ai | 2026-08-21 | 2026-10-15 |
| CVE-2026-106620 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-88131 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized... |
critical | 9.8 | — | Microsoft / dataverse | 2026-10-08 | 2026-10-15 |
| CVE-2026-96207 Improper certificate validation in Microsoft Partner Center allows an unauthoriz... |
critical | 10.0 | — | Microsoft / partner center | 2026-10-08 | 2026-10-15 |
| CVE-2026-106622 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106621 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106619 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
critical | 9.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106624 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2018-7489 FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2018-02-26 | 2026-10-15 |
| CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to... |
critical | 9.8 | — | Apache / tomcat | 2018-05-16 | 2026-10-15 |
| CVE-2018-19857 The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may re... |
critical | 9.1 | — | Videolan / vlc media player | 2018-12-05 | 2026-10-15 |
| CVE-2018-19361 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-19362 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-19360 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond... |
critical | 10.0 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-14720 FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct ext... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2026-19622 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass auth... |
critical | 9.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-97668 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92097 The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-19593 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata... |
critical | 9.8 | — | — | 2026-09-01 | 2026-10-15 |
| CVE-2026-110002 The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108291 Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108587 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-104800 The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104748 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-84249 IBM Guardium Data Protection 12.2, and 12.2.2 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-73595 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
critical | 9.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-9191 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.6 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-101956 An Improper Authentication vulnerability in the J-Web web management component o... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33789 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33792 A Stack-based Buffer Overflow vulnerability in the srxpfe process of Juniper Net... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-33796 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-101983 A Stack-based Buffer Overflow vulnerability in the httpd process of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.