October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95638 Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95639 Photoshop Desktop is affected by an Incorrect Authorization vulnerability that c... |
high | 8.6 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2015-20124 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path trave... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-114107 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114391 ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonM... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2021-48015 JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerab... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vul... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerabil... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-95641 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-22 |
| CVE-2026-95696 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
high | 7.5 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-113779 The pfSense REST API package is an unofficial, open-source REST and GraphQL API... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-98122 In the Linux kernel, the following vulnerability has been resolved:
vxlan: mdb:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-97237 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-09-30 | 2026-10-22 |
| CVE-2026-76066 IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-76530 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Web... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-114097 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in Comm... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unau... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101820 Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101823 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101825 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101826 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101827 Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101829 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101797 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101816 Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (comp... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101791 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101796 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101783 Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: Ge... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101786 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101744 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101746 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 7.3 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101758 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101759 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101768 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101719 Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component:... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101739 Vulnerability in the Oracle Agile Engineering Data Management product of Oracle... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101742 Vulnerability in the Oracle Applications Manager product of Oracle E-Business Su... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.