October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101707 Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business S... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101694 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101698 Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101699 Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101703 Vulnerability in the Pasta product of Oracle E-Business Suite (component: Intern... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101688 Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101690 Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-114045 FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side r... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113081 Use after free in Compositing in Google Chrome prior to 156.0.8078.47 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-98130 In the Linux kernel, the following vulnerability has been resolved:
sctp: fix a... |
high | 8.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-22 |
| CVE-2026-113161 Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-109927 The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability chec... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-109987 The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress pl... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111958 The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-97328 The WebP Express WordPress plugin before 0.25.16 does not escape values that its... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114177 Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xp... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-111830 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112242 Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profi... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112312 Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended al... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112820 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112822 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-106488 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-oidc-provider | 2026-10-06 | 2026-10-22 |
| CVE-2026-76505 A vulnerability in the IPv4 packet processing functionality of Cisco IOS XR Soft... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76524 A vulnerability in the control channel socket implementation of Open Source Snor... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76490 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76491 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76492 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76493 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20356 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-70108 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70111 Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70114 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70117 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70121 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70144 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70160 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70176 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70209 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.