October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116390 Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything —... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115328 JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi()... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115355 Mistune before 3.3.0 contains a path traversal vulnerability in the Include dire... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114624 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115457 baserCMS is a website development framework. |
high | 7.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115591 Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Con... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115593 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115590 Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allow... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115603 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111850 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-100353 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-2100 A flaw was found in p11-kit. |
high | 7.5 | — | P11-kit Project / p11-kit | 2026-03-26 | 2026-10-29 |
| CVE-2026-112085 webpack-dev-server is a development server that provides live reloading for webp... |
high | 8.2 | — | Webpack.js / webpack-dev-server | 2026-10-22 | 2026-10-29 |
| CVE-2026-94109 openEQUELLA before 2026.1.0 contains an authenticated stored server-side templat... |
high | 8.0 | — | — | 2026-09-20 | 2026-10-29 |
| CVE-2026-67615 openEQUELLA before 2026.1.0 contains an authenticated remote code execution vuln... |
high | 8.8 | — | — | 2026-09-22 | 2026-10-29 |
| CVE-2026-56834 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-52356 An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-42693 Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-29 |
| CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties... |
high | 7.5 | Listed | Atlassian / Multiple Products | 2026-10-05 | 2026-10-29 |
| CVE-2026-115726 Aider through 0.86.2 contains a command execution vulnerability that allows atta... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115505 libsmb2 before 6.3 contains integer overflow vulnerabilities in the DCE/RPC NDR... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-66281 In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can resu... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-66282 In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can r... |
high | 7.5 | — | Silabs / emberznet | 2026-10-22 | 2026-10-29 |
| CVE-2026-61791 OCO-Server is a self-hosted endpoint management application for computer invento... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-75508 GraphQL-core is a Python port of the GraphQL.js reference implementation. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-25439 Authentication Bypass Using an Alternate Path or Channel vulnerability in Bookne... |
high | 8.1 | — | — | 2026-06-17 | 2026-10-29 |
| CVE-2026-115324 mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115332 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2018-25439 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /inclu... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48013 Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthen... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48017 OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthent... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51024 Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-94347 PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-87102 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-87103 Sensitive information disclosure and manipulation due to improper token validati... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83363 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83393 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86379 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86378 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83361 Vulnerability in the Oracle Contract Lifecycle Management for Public Sector prod... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.