October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-13738 CommServe contained an authorization bypass vulnerability affecting a limited se... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
| CVE-2026-13739 A legacy endpoint in Command Center contained an unauthenticated server-side req... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
| CVE-2026-16860 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec... |
critical | 9.9 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-17276 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to esca... |
critical | 9.9 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-17111 IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. |
critical | 9.8 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-10543 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil... |
critical | 9.8 | — | Ibm / db2 | 2026-08-12 | 2026-10-23 |
| CVE-2026-13433 IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to do... |
critical | 9.6 | — | Ibm / i access client solutions | 2026-08-12 | 2026-10-23 |
| CVE-2026-10534 IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer... |
critical | 9.8 | — | Ibm / db2 | 2026-08-12 | 2026-10-23 |
| CVE-2026-12665 IBM MQ could allow a remote attacker to execute arbitrary code due to a stack bu... |
critical | 9.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-91638 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91658 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91663 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-111643 Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-115375 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulner... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115547 An input validation issue in the Okta Access Gateway (OAG) Admin Console allows... |
critical | 9.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112860 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112862 Deserialization of Untrusted Data vulnerability in xnau webdesign Participants D... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112853 Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallel... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112857 Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo a... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114607 Better Auth is an authentication and authorization library for TypeScript. |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-100886 A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4... |
critical | 10.0 | — | — | 2026-09-27 | 2026-10-23 |
| CVE-2026-104252 Vitess is a database clustering system for horizontal scaling of MySQL. |
critical | 9.8 | — | Linuxfoundation / vitess | 2026-10-13 | 2026-10-23 |
| CVE-2026-106486 Backstage is an open framework for building developer portals. |
critical | 9.9 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend-module-bitbucket-cloud | 2026-10-06 | 2026-10-23 |
| CVE-2026-91637 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.9 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-94267 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced C... |
critical | 9.0 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2019-15598 A Code Injection exists in treekill on Windows which allows a remote code execut... |
critical | 9.8 | — | Tree-kill Project / tree-kill | 2019-12-18 | 2026-10-23 |
| CVE-2023-4548 A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. |
critical | 9.8 | — | Spa-cart / ecommerce cms | 2023-08-26 | 2026-10-23 |
| CVE-2026-92559 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attack... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111814 Apache Traffic Server's default outbound session-sharing policy can reuse a pool... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111815 Apache Traffic Server can resume a TLS session across SNI virtual hosts without... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111183 GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerabi... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-111812 Apache Traffic Server's origin_server_auth plugin lets a client force signing of... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-75885 A flaw was found in the OpenShift console. |
critical | 9.3 | — | — | 2026-09-18 | 2026-10-23 |
| CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerabil... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113678 Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91665 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.8 | — | Oracle / essbase | 2026-10-20 | 2026-10-22 |
| CVE-2026-76466 A vulnerability in the database service feature of Cisco Expressway Series could... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76474 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-101590 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.