October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76301 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114382 A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111809 Apache Traffic Server allows request smuggling via HEAD requests that carry Cont... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2024-51092 LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via O... |
critical | 9.1 | — | Librenms / librenms | 2026-05-08 | 2026-10-27 |
| CVE-2026-91656 Vulnerability in Oracle Essbase (component: Federated Partitions). |
critical | 9.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shar... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114108 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vul... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-112398 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2024-31026 An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allow... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-27 |
| CVE-2024-34320 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect acces... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-34323 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2024-4457 The Management Console fails to properly validate input related to the configura... |
critical | 9.1 | — | — | 2026-10-18 | 2026-10-27 |
| CVE-2026-105008 No cwe for this issue in Windows Schannel allows an unauthorized attacker to per... |
critical | 9.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-76473 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2024-11080 The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnera... |
critical | 9.8 | — | — | 2026-09-05 | 2026-10-27 |
| CVE-2024-58309 xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allo... |
critical | 9.8 | — | Xbtitfm / xbtitfm | 2025-12-11 | 2026-10-27 |
| CVE-2024-14010 Typora 1.7.4 contains a command injection vulnerability in the PDF export prefer... |
critical | 9.8 | — | — | 2025-12-12 | 2026-10-27 |
| CVE-2024-57521 SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker... |
critical | 10.0 | — | Ruoyi / ruoyi | 2025-12-23 | 2026-10-27 |
| CVE-2024-44065 Time-based blind SQL Injection vulnerability in Cloudlog v2.6.15 at the endpoint... |
critical | 9.8 | — | Magicbug / cloudlog | 2025-12-26 | 2026-10-27 |
| CVE-2024-25181 A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allo... |
critical | 9.1 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-25182 givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php. |
critical | 9.8 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-27480 givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload. |
critical | 9.8 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-58351 Flowise before 2.1.4 allows configuration to be injected into the Chainflow duri... |
critical | 9.8 | — | — | 2026-06-20 | 2026-10-27 |
| CVE-2024-51311 The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51313 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51312 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51314 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2024-51315 The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the su... |
critical | 9.8 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2026-101420 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
critical | 9.6 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-110720 Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authori... |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116504 A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 9.9 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112403 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112900 Pillow is a Python imaging library. |
critical | 9.8 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-92885 The Qode Membership plugin for WordPress is vulnerable to Authentication Bypass... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-91491 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.8 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91490 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
critical | 9.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91655 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-109705 Sandbox escape, site isolation issue due to incorrect boundary conditions, use-a... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109707 Sandbox escape due to use-after-free in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-109708 Sandbox escape due to incorrect boundary conditions in the Networking component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.