October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,080
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,902
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91354 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-39795 Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-28 |
| CVE-2026-103688 The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google... |
critical | 9.8 | Listed | Google / brotli | 2026-10-22 | 2026-10-28 |
| CVE-2026-70153 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70147 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-74990 Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74989 Internally found bugs present in Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74988 Internally found bugs present in Firefox ESR 153.0 and Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74987 Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firef... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113744 A security vulnerability has been detected in Tenda AC19 16.03.10.07. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112352 Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability t... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-104354 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103409 A Missing authentication for critical function vulnerability in Juniper Networks... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103406 An Improper Neutralization of Special Elements used in an OS Command vulnerabili... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-70157 Heap-based buffer overflow in Windows System Information Console allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81212 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to pe... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-115968 Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Memb... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113736 A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111411 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111057 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 10.0 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-115915 vLLM is an inference and serving engine for large language models. |
critical | 9.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-114278 The che-machine-exec service constructs a shell command by concatenating user-co... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118477 The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFa... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115904 Topluyo is a social networking platform. |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language mode... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-110879 jackson-databind validates the outer class of a class-name type ID but accepts a... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-114595 In EPICS Base release 7.0.10 and prior, an integer overflow in network request p... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-58256 GRR is a resource management and reservation application. |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-87347 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com... |
critical | 9.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-105489 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103799 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
critical | 9.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-104350 Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XS... |
critical | 9.3 | — | — | 2026-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.