October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101484 Vulnerability in Oracle Secure Backup (component: Backup and Restore). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-101521 Vulnerability in Oracle APEX (component: General). |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-77930 EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that a... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113390 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112370 A vulnerability was found in H3C Magic NX15 100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-109444 OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability th... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-105016 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-73373 Joomla! |
critical | 9.8 | — | Joomla / joomla\! | 2026-08-18 | 2026-10-22 |
| CVE-2026-47606 NVIDIA Triton Inference Server for Linux contains a vulnerability where an attac... |
critical | 9.1 | — | Nvidia / triton inference server | 2026-08-18 | 2026-10-22 |
| CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiOS | 2024-02-09 | 2026-10-22 |
| CVE-2026-114220 NT OneAPP developed by NewType Infortech has an Improper Certificate Validation... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-93909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnera... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-93895 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-95695 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-92892 Potential arbitrary code execution under specific configurations. |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-76299 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76302 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76531 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-92812 Decap CMS before 3.11.0 contains a path traversal vulnerability in the local pro... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-22 |
| CVE-2020-21012 Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenti... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2021-10-01 | 2026-10-22 |
| CVE-2026-112241 Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart sur... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112832 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-76475 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2024-26011 A missing authentication for critical function vulnerability in Fortinet FortiMa... |
critical | 9.8 | — | Fortinet / fortios | 2024-11-12 | 2026-10-22 |
| CVE-2024-48884 A improper limitation of a pathname to a restricted directory ('path traversal')... |
critical | 9.1 | — | Fortinet / fortimanager | 2025-01-14 | 2026-10-22 |
| CVE-2026-107081 SQL injection via identifier injection in the tableName and tableFields POST par... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111704 LangChat through commit 2a6285a contains a missing authentication vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-101634 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91624 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101499 Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101537 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101763 Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101765 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101767 Vulnerability in the Oracle Application Object Library product of Oracle E-Busin... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101808 Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-60432 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-83399 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-91220 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-111832 Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP... |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.