October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,371
Critical
1,328
High
5,804
Medium
6,212
Low
648
Severity not reported
3,379
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101429 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.0 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101431 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101434 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101421 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-29 |
| CVE-2026-101422 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101410 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-101411 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101416 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101409 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101398 Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101387 Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-101388 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101390 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-94266 libcurl could accidentally return a URL for `curl_easy_getinfo()`'s
`CURLINFO_EF... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92386 When writing a long cookie name and value to a Netscape cookie jar, a remote
HTT... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-92387 By permanently omitting the final control-response line, a malicious FTP,
IMAP,... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-92389 libcurl's TFTP state machine fails to validate state transitions against the
req... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92390 When invoked with `--remote-header-name` (`-J`), curl fails to preserve its
docu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92391 A deeply nested multipart MIME structure constructed via the public API causes
a... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86415 libcurl's connection cache match function never considers the automatic client
c... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87862 Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
en... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87863 An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87864 Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87865 When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated
initial... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-111758 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112407 Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serve... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-107928 When curl is built with GnuTLS, a malicious WebSocket server can make curl
send... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-107929 When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is
se... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2016-20103 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2016-20104 EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path tra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-103672 The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path trave... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2015-20125 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vuln... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2015-20123 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2012-20002 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.