October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112362 @fastify/express is a Fastify plugin that runs Express middleware inside Fastify... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65145 NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause... |
critical | 10.0 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117532 REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerabi... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82119 OS Command Injection Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-112403 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112900 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-116505 A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116506 A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116508 A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-92885 The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-96639 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-21 | 2026-10-27 |
| CVE-2026-91491 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.8 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91490 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91655 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate M... |
critical | 9.8 | — | Ordasoft / real estate manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef... |
critical | 10.0 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manag... |
critical | 9.8 | — | Ordasoft / vehicle manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-63938 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: C... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-91644 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-63922 In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthd... |
critical | 9.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.