October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,204
Critical
1,207
High
5,399
Medium
5,731
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101767 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101763 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101765 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101634 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101590 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101537 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101528 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101529 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101521 Vulnerability in Oracle APEX (component: General). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101499 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101501 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101503 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101484 Vulnerability in Oracle Secure Backup (component: Backup and Restore). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101446 Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101420 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
critical | 9.6 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-9827 A arbitrary file write vulnerability exists in the boa formUploadFile functional... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9869 A stack-based buffer overflow vulnerability exists in the boa formTR069Config fu... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9659 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice h... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr f... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice m... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-112712 @fastify/middie is the Express-style middleware engine for Fastify. |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X20... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.