October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,924
Critical
3,121
High
7,062
Medium
6,894
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110744 A flaw was found in multicluster-global-hub-operator-bundle. |
high | 7.2 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-104068 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitra... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2021-48018 Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentr... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-91651 Vulnerability in Oracle Essbase (component: Essbase Web Platform). |
high | 8.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-17545 On Windows, PHP's filesystem and stream APIs do not reject reserved device names... |
high | 7.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-109198 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPres... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115497 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Dire... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109936 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a patter... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111982 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a us... |
high | 7.2 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113499 The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its H... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113500 The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94262 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-94268 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
high | 8.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113682 Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vul... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level wi... |
high | 7.5 | — | Php / php | 2026-09-25 | 2026-10-23 |
| CVE-2026-92183 GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnera... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92208 NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. |
high | 8.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-92209 NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-76587 IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overfl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-82891 IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obt... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-87351 Vulnerability in Oracle GoldenGate (component: Admin Server Executable). |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111184 NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-101481 Vulnerability in Oracle Secure Backup (component: Device Management and Support)... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101482 Vulnerability in Oracle Secure Backup (component: Device Management and Support)... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-39769 Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-23 |
| CVE-2026-75887 A flaw was found in the OpenShift console. |
high | 7.5 | — | — | 2026-09-23 | 2026-10-23 |
| CVE-2026-108334 A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant op... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-91478 Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Ora... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113727 OpenChoreo is a developer platform for Kubernetes. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2016-20100 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-101398 Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (compone... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2014-125134 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113658 ApostropheCMS is an open-source Node.js content management system. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113606 Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-96251 Reliance on untrusted inputs in a security decision in Microsoft PowerShell allo... |
high | 8.8 | — | Microsoft / powershell | 2026-10-13 | 2026-10-22 |
| CVE-2026-93888 IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-76478 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76479 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76494 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.