October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101382 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-101383 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-101367 Vulnerability in Oracle REST Data Services (component: ADP). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101368 Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101369 Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101374 Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101359 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101360 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101361 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 4.2 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101362 Vulnerability in Oracle REST Data Services (component: Core). |
medium | 6.9 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101363 Vulnerability in Oracle REST Data Services (component: Graph QL). |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101364 Vulnerability in Oracle REST Data Services (component: Database Actions). |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101365 Vulnerability in Oracle REST Data Services (component: Database Actions). |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101366 Vulnerability in Oracle REST Data Services (component: ADP). |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2025-60475 A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) o... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-60494 A segmentation violation in the gf_props_equal_internal function (/filter_core/f... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-60496 A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-110322 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/re... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-105960 PEAK-System PCAN contains a vulnerable operation involving a variable-length rec... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-109576 The parser in PEAK-System PCAN driver correctly detected the malformed record, b... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101103 The PEAK-System PCAN diagnostic call did not validate that the caller-supplied o... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2016-20102 JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2012-20005 SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scr... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2014-125131 DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2014-125132 Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site s... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2012-20003 Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2012-20004 K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripti... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113724 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113866 When setting up an account, Thunderbird's Exchange AutoDiscover lookup also quer... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113868 When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not che... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113869 When Thunderbird asked for a security device password (for example a smartcard P... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113719 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113721 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-113716 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-107692 The War Thunder game client transmits its authentication bearer token (auth_jwt)... |
medium | 4.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113643 A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-111088 A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-100132 Acrobat for Edge is affected by an out-of-bounds read vulnerability that could l... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113668 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.