October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,924
Critical
3,121
High
7,062
Medium
6,894
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69452 Use after free in Windows Enterprise App Management allows an authorized attacke... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69471 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69521 Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-91635 Vulnerability in Oracle Essbase (component: Security). |
high | 8.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91647 Vulnerability in Oracle Essbase (component: Security). |
high | 8.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-111638 sshportal through 1.19.5 contains a missing authorization vulnerability in the m... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-97635 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided inpu... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might a... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-91664 Vulnerability in Oracle Essbase (component: Security). |
high | 7.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-115371 Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115374 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verificatio... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112778 Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation f... |
high | 8.8 | — | Traefik / traefik | 2026-10-19 | 2026-10-23 |
| CVE-2026-112390 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-23 |
| CVE-2026-112391 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-23 |
| CVE-2026-115546 Okta Access Gateway (OAG) does not validate the selected authentication source d... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-55459 The Goobi viewer is a web application that allows digitised material to be displ... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111663 Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2014-125133 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2015-20128 FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20104 EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path tra... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-57486 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-57487 pupnp is an SDK for development of UPnP device and control point applications. |
high | 7.5 | — | Pupnp Project / pupnp | 2026-10-16 | 2026-10-23 |
| CVE-2026-112359 Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112837 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112849 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-102917 IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevatin... |
high | 7.8 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-10572 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10574 IBM MQ could allow an authenticated attacker to cause a denial of service or pot... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-10743 IBM MQ could allow an authenticated attacker to cause a denial of service or cor... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-76307 In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-57121 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-57113 PraisonAI is a multi-agent teams system. |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115723 Snap7 through 1.4.3 contains an out-of-bounds write vulnerability in the passive... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115727 AgenticSeek before commit 409840c contains a remote code execution vulnerability... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted defau... |
high | 8.4 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115325 Netmaker through 1.7.0 contains an authorization bypass vulnerability in the upd... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-114137 Django REST framework is a toolkit for building Web APIs. |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-114145 GitPython is a python library used to interact with Git repositories. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.