October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-50056 A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimb... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-50057 A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZC... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-47486 NVIDIA PhysX for all platforms contains a vulnerability where an attacker could... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-48379 Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111422 In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the va... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-113775 A maliciously crafted dynamic library, when loaded from an arbitrary path throug... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-107672 A maliciously crafted .stack.json file can trigger a trusted Markdown injection... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-104349 Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulner... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-101834 Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101841 Vulnerability in the Global Order Promising product of Oracle E-Business Suite (... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101842 Vulnerability in the Strategic Network Optimization product of Oracle E-Business... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101852 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101853 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101854 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101557 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101567 Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101831 Vulnerability in the Oracle Quality product of Oracle E-Business Suite (componen... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2024-3727 A flaw was found in the github.com/containers/image library. |
high | 8.3 | — | — | 2024-05-14 | 2026-10-29 |
| CVE-2024-3056 A flaw was found in Podman. |
high | 7.7 | — | Podman Project / podman | 2024-08-02 | 2026-10-29 |
| CVE-2026-94346 PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 throu... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-92709 Rsyslog is a rocket-fast system for log processing. |
high | 8.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-86380 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86385 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, con... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-74580 In the Linux kernel, the following vulnerability has been resolved:
vhost: rese... |
high | 8.8 | — | — | 2026-08-21 | 2026-10-29 |
| CVE-2026-56840 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57144 PraisonAI is a multi-agent teams system. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-56835 PraisonAI is a multi-agent teams system. |
high | 8.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-118339 Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118341 Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118344 Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118334 Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-115504 CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2()... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115484 A flaw was found in the iscsiuio component of open-iscsi. |
high | 7.6 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115372 Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115376 Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115392 Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0... |
high | 7.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115331 Lotus through 0.10.2 contains an sql injection vulnerability that allows authent... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115323 EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in th... |
high | 7.3 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114605 dnspython is a DNS toolkit for Python. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-112332 Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetD... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.