October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,080
Critical
3,182
High
7,360
Medium
6,922
Low
714
Severity not reported
4,902
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1394), google (802), ibm (323), mozilla (182), oracle (157), adobe (147), linux (129), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18450 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116504 A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112362 @fastify/express is a Fastify plugin that runs Express middleware inside Fastify... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65145 NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause... |
critical | 10.0 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117532 REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerabi... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76932 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76933 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76934 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76935 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76936 Stack-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76937 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76938 Authentication Bypass Vulnerability in JP1/Automatic Job Management System 3. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-76939 Heap-based Buffer Overflow Vulnerability in JP1/Automatic Job Management System... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82116 Missing Authentication for Critical Function Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82117 Authentication Bypass by Spoofing Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82118 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82119 OS Command Injection Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82120 Heap-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-82122 Stack-based Buffer Overflow Vulnerability in HiRDB. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86574 Heap-based Buffer Overflow Vulnerability in JP1/Base. |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86575 Stack-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86576 Heap-based Buffer Overflow Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-86577 Out-of-bounds Write Vulnerability in JP1 Products. |
critical | 9.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-112403 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112900 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-116505 A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116506 A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116508 A security flaw has been discovered in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-92885 The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-91491 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.8 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91490 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91655 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate M... |
critical | 9.8 | — | Ordasoft / real estate manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-110264 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 bef... |
critical | 10.0 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-27 |
| CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manag... |
critical | 9.8 | — | Ordasoft / vehicle manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-63938 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: C... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-91644 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.