October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101809 Vulnerability in the Workflow product of Oracle E-Business Suite (component: Wor... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-24 |
| CVE-2026-9827 A arbitrary file write vulnerability exists in the boa formUploadFile functional... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9869 A stack-based buffer overflow vulnerability exists in the boa formTR069Config fu... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9660 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9814 An OS command injection vulnerability exists in the boa formWizard newPass funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-9817 A stack-based buffer overflow vulnerability exists in the boa formUploadFile fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42025 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42026 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-35499 An os command injection vulnerability exists in the boa formWsc peerRptPin funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42021 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42022 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42023 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-42024 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10138 A OS command injection vulnerability exists in the boa formUpload() functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10139 A stack-based buffer overflow vulnerability exists in the Mcli functionality of... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10141 A Unsigned Firmware vulnerability exists in the boa Firmware Update functionalit... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10131 An OS command injection vulnerability exists in the boa formPasswordSetup functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10132 A stack-based buffer overflow vulnerability exists in the boa formIpQos mac func... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10133 A stack-based buffer overflow vulnerability exists in the batchupg functionality... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10135 A OS command injection vulnerability exists in the batchupg functionality of X20... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10136 A heap-based buffer overflow vulnerability exists in the boa formUpload() functi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-10137 A stack-based buffer overflow vulnerability exists in the boa formUpload() funct... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2023-24482 A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3... |
critical | 9.8 | — | Siemens / comos | 2023-02-14 | 2026-10-23 |
| CVE-2023-30191 PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitem... |
critical | 9.8 | — | Cdesigner Project / cdesigner | 2023-05-17 | 2026-10-23 |
| CVE-2023-2186 On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticat... |
critical | 9.8 | — | Trianglemicroworks / scada data gateway | 2023-06-07 | 2026-10-23 |
| CVE-2023-29542 A newline in a filename could have been used to bypass the file extension securi... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-23 |
| CVE-2026-34977 Aperi'Solve is an open-source steganalysis web platform. |
critical | 9.8 | — | Aperisolve / aperisolve | 2026-04-06 | 2026-10-23 |
| CVE-2026-34989 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35044 BentoML is a Python library for building online serving systems optimized for AI... |
critical | 9.6 | — | Bentoml / bentoml | 2026-04-06 | 2026-10-23 |
| CVE-2026-35047 Brave CMS is an open-source CMS. |
critical | 9.8 | — | Ajax30 / bravecms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35052 D-Tale is the combination of a Flask back-end and a React front-end to view & an... |
critical | 9.8 | — | Man / d-tale | 2026-04-06 | 2026-10-23 |
| CVE-2026-5734 Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire... |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-5735 Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-16184 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-14974 IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote a... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-14976 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. |
critical | 9.1 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-58177 The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver... |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Ca... |
critical | 9.8 | — | Aimy-extensions / aimy captcha-less form guard | 2026-07-29 | 2026-10-23 |
| CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.