October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,927
Critical
3,121
High
7,064
Medium
6,895
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-34486 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability |
high | 7.5 | Listed | Apache / Tomcat | 2026-04-09 | 2026-10-26 |
| CVE-2026-34197 Apache ActiveMQ Improper Input Validation Vulnerability |
high | 8.8 | Listed | Apache / ActiveMQ | 2026-04-07 | 2026-10-26 |
| CVE-2025-57231 Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticate... |
high | 7.5 | — | — | 2026-09-10 | 2026-10-26 |
| CVE-2026-91625 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91627 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91623 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91610 Vulnerability in Oracle REST Data Services (component: General). |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91608 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91604 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91597 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91579 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91568 Vulnerability in the RDBMS component of Oracle Database Server. |
high | 7.7 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91573 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91563 Vulnerability in the Oracle OLAP component of Oracle Database Server. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91557 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91550 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91546 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91549 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91545 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91539 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91534 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91535 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-109556 EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnera... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109422 NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109361 MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in n... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-34621 Adobe Acrobat and Reader Prototype Pollution Vulnerability |
high | 8.6 | Listed | Adobe / Acrobat and Reader | 2026-04-11 | 2026-10-26 |
| CVE-2026-77692 An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS reque... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-81736 If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is the... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-19666 On a resolver configured to use ``dns64``, if an applicable answer from the auth... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-76163 If BIND is loaded with a "`named.conf`" file that contains no global "`options`"... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-80274 If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2025-70517 The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70522 The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-61560 A race condition vulnerability in the SessionManager of CNCF: Cloud Native Compu... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-26 |
| CVE-2026-56386 Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure wi... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-94300 Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`name... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-96888 A BIND resolver that is configured with both a "redirect" zone and "qname-minimi... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-97313 A recursive BIND server that receives a query with recursion desired (RD=1) foll... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-112394 Pillow is a Python imaging library. |
high | 8.2 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.