October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,410
Critical
3,098
High
6,954
Medium
6,692
Low
597
Severity not reported
4,069
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (671), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100839 Contrast is a confidential-computing runtime for Kubernetes. |
high | 8.4 | — | — | 2026-09-27 | 2026-10-08 |
| CVE-2026-100645 SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnera... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100680 Budibase versions before 3.45.0 fail to disable external JSON reference resoluti... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100682 Budibase Server before 3.45.0 contains an arbitrary file write vulnerability in... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100683 Budibase (@budibase/server) before 3.45.0 builds MySQL and MSSQL column-rename D... |
high | 8.0 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100684 Budibase versions 3.41.0 before 3.45.0 contain an authentication bypass in the O... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100685 Budibase before 3.45.0 fails to properly scope the GET /api/chat-links endpoint... |
high | 7.7 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100644 SiYuan before v3.8.4 contains a SQL injection vulnerability in the graph query e... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100532 @openclaw/whatsapp (npm) before 2026.8.1 exposes the WhatsApp login tool through... |
high | 8.1 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100541 OpenClaw's Matrix integration (npm package @openclaw/matrix) versions >= 2026.2.... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100544 openclaw's @openclaw/voice-call package before 2026.8.1 launches the configured... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2026-100575 OpenClaw Slack versions before 2026.8.1 fail to properly enforce sender allowlis... |
high | 8.8 | — | — | 2026-09-26 | 2026-10-08 |
| CVE-2023-54393 PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability i... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2023-54355 PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identit... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2023-54390 PocketMine-MP versions before 5.3.1 and 4.23.1 contain a denial of service vulne... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-08 |
| CVE-2022-51017 PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of sk... |
high | 7.5 | — | — | 2026-09-07 | 2026-10-08 |
| CVE-2022-51009 PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore... |
high | 7.5 | — | — | 2026-09-06 | 2026-10-08 |
| CVE-2026-20521 In Video HAL, there is a possible escalation of privilege due to a missing bound... |
high | 8.4 | — | Mediatek / mt8910 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-67410 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-08 |
| CVE-2026-20522 In neuropilot, there is a possible out of bounds write due to a missing bounds c... |
high | 8.4 | — | Mediatek / mt6881 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-20524 In apu, there is a possible memory corruption due to improper input validation. |
high | 8.4 | — | Mediatek / mt6899 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-87158 Vulnerability in the Oracle Order Management product of Oracle E-Business Suite... |
high | 7.1 | — | Oracle / order management enterprise command center | 2026-09-15 | 2026-10-08 |
| CVE-2026-87157 Vulnerability in the Oracle Order Management product of Oracle E-Business Suite... |
high | 8.1 | — | Oracle / order management enterprise command center | 2026-09-15 | 2026-10-08 |
| CVE-2026-18154 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18153 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.1 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-18152 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
high | 7.5 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-08 |
| CVE-2026-106219 In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs a... |
high | 7.5 | — | Jetbrains / teamcity | 2026-10-06 | 2026-10-08 |
| CVE-2026-87150 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 8.8 | — | Oracle / bills of material | 2026-09-15 | 2026-10-08 |
| CVE-2026-20519 In Modem, there is a possible out of bounds write due to a missing bounds check. |
high | 7.5 | — | Mediatek / mt6833 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-87151 Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite... |
high | 7.7 | — | Oracle / bills of material | 2026-09-15 | 2026-10-08 |
| CVE-2026-20520 In Modem, there is a possible out of bounds write due to a missing bounds check. |
high | 7.5 | — | Mediatek / mt2716 firmware | 2026-10-05 | 2026-10-08 |
| CVE-2026-83482 Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (compon... |
high | 7.2 | — | Oracle / e-business suite | 2026-09-15 | 2026-10-08 |
| CVE-2026-54472 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of H... |
high | 7.5 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-106212 Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allo... |
high | 8.8 | — | Google / chrome | 2026-10-06 | 2026-10-08 |
| CVE-2026-91803 A local privilege escalation vulnerability exists in the updater of Foxit PDF Ed... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91809 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of m... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91812 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-... |
high | 8.1 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91813 A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update p... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91815 Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
| CVE-2026-91816 A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of P... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.