October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112770 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code executi... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-91349 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91350 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-87369 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91254 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91255 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91344 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91345 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-82814 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-115482 In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114219 NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerabil... |
high | 7.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113872 multer is a middleware for Node.js that handles multipart/form-data file uploads... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-101810 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-110353 HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a den... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-110354 HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denia... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111181 body-parser is body parsing middleware for Node.js and Express. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-101572 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101679 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101520 Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework pr... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-96912 Use after free in Windows Client License Service allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96911 Improper link resolution before file access ('link following') in Microsoft Wind... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96914 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) En... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96913 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-83661 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-93905 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allo... |
high | 8.2 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in creat... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows pub... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101830 Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101815 Vulnerability in the Assets product of Oracle E-Business Suite (component: Inter... |
high | 7.6 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101818 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101822 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101785 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101769 Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster:... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101735 Vulnerability in the Primavera Unifier product of Oracle Construction and Engine... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101689 Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O... |
high | 7.7 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-106565 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-106567 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-95635 Photoshop Desktop is affected by a Double Free vulnerability that could result i... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95636 Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95637 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.