October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,956
Critical
3,122
High
7,073
Medium
6,906
Low
609
Severity not reported
4,246
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76408 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-76529 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-62131 Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62015 Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62016 Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62003 Unauthenticated PHP Object Injection in Mission <= 1.22 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62004 Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62005 Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62009 Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62010 Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62011 Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-62014 Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61991 Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versi... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61992 Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61997 Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61998 Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54856 Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54857 Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-54860 Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. |
critical | 9.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-107060 Insecure permissions in Tailscale versionCode 297862600 allows unauthorized atta... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107034 Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauth... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107017 Insecure permissions in the ShortcutDispatchActivity component of canvoki versio... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-107028 Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows un... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2025-13204 npm package `expr-eval` is vulnerable to Prototype Pollution. |
critical | 9.8 | — | Silentmatt / javascript expression evaluator | 2025-11-14 | 2026-10-30 |
| CVE-2026-48382 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-101986 An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS a... |
critical | 9.8 | — | Juniper / junos os evolved | 2026-10-14 | 2026-10-30 |
| CVE-2026-101990 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | Juniper / junos os evolved | 2026-10-14 | 2026-10-30 |
| CVE-2026-93291 Omni C20 lacks proper certificate validation which could allow an attacker to pe... |
critical | 9.4 | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-93680 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass se... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-90865 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90866 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90868 An OS command injection vulnerability in Progress Software WS_FTP Server version... |
critical | 9.9 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FT... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90864 A path traversal vulnerability in Progress Software WS_FTP Server versions prior... |
critical | 9.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-86400 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86397 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-84295 Improper authentication in Progress Software WS_FTP Server versions prior to 202... |
critical | 10.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-59562 Missing authentication for critical function vulnerability in Apache IoTDB. |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.