October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114576 A vulnerability has been found in Linksys RE6250 1.0.04.001. |
low | 3.7 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-14288 GitLab has remediated an issue in GitLab EE affecting all versions from 17.4 bef... |
low | 3.1 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-103515 GitLab has remediated an issue in GitLab EE affecting all versions from 19.2 bef... |
low | 2.7 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0... |
low | 3.5 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-112326 GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 bef... |
low | 3.1 | — | Gitlab / gitlab | 2026-10-22 | 2026-10-30 |
| CVE-2026-114377 A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.... |
low | 3.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-18748 The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struc... |
low | 3.5 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114124 Electron is a framework for writing cross-platform desktop applications using Ja... |
low | 3.9 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114122 Electron is a framework for writing cross-platform desktop applications using Ja... |
low | 3.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113797 Electron is a framework for writing cross-platform desktop applications using Ja... |
low | 3.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114472 Insufficient resource pool in the ACME HTTP-01 challenge responder of Progressiv... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114370 A flaw was found in the PathResourceManager component of the Undertow web server... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-87096 Sensitive information disclosure and manipulation due to improper authorization... |
low | 3.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-35501 When NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured w... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-104642 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted... |
low | 2.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing c... |
low | 3.3 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-96901 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-105257 The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify tha... |
low | 2.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114040 A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. |
low | 3.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114115 Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114070 Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability... |
low | 3.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114071 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that al... |
low | 3.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114048 WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in l... |
low | 3.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114049 vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() t... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2020-37288 Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2020-37289 Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared... |
low | 3.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113735 A vulnerability was determined in D-Link DCS-6501LH 3.03.02. |
low | 3.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113706 A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. |
low | 3.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-9825 IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sens... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91650 Vulnerability in Oracle Essbase (component: Java Based Agent). |
low | 3.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91612 Vulnerability in the Oracle Communications Unified Inventory Management product... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91613 Vulnerability in the Oracle Communications Unified Inventory Management product... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91614 Vulnerability in the Oracle Communications Unified Inventory Management product... |
low | 3.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91616 Vulnerability in the Oracle Middleware Common Libraries and Tools product of Ora... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91582 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91485 Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle... |
low | 3.8 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91477 Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX)... |
low | 3.1 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91471 Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91461 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
low | 3.7 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-91436 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
low | 3.9 | — | — | 2026-10-20 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.