October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111834 Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang... |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111852 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113802 Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command inj... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101501 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101503 Vulnerability in Oracle Trusted Answer Search (component: PLSQL package). |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101528 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101529 Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Or... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-90042 In the Linux kernel, the following vulnerability has been resolved:
ceph: prope... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-90036 In the Linux kernel, the following vulnerability has been resolved:
NFSD: Preve... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-83888 Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-106173 A improper limitation of a pathname to a restricted directory ('path traversal')... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-21 |
| CVE-2026-92262 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-21 |
| CVE-2026-44977 countly-server is the server-side part of Countly, a product analytics solution. |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-49868 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-26846 Buffer Overflow vulnerability in WEINVEIW CO.,LTD EBPro v.6.10.01.510_20251022 a... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111375 FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
critical | 9.1 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111281 Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a re... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-57496 NetLicensing MCP Server is a natural-language interface that enables agentic app... |
critical | 9.6 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-102182 A Stack-based Buffer Overflow vulnerability in the kmd component of Juniper Netw... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-71253 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107188 A user can upload export reports with any file contents and specify any contents... |
critical | 9.6 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-97162 Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extens... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-109442 piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113703 SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its l... |
critical | 9.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-97163 Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP pl... |
critical | 9.8 | — | Lomart / up | 2026-09-26 | 2026-10-20 |
| CVE-2026-109395 Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerabi... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-75128 Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77936 Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECU... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113620 In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upg... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-101356 Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting H... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-103119 Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112371 A vulnerability was determined in H3C Magic NX15 NX15V100R017. |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-113389 A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113391 A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113506 A vulnerability has been found in aaPanel up to 8.25.0. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-35561 Insufficient authentication security controls in the browser-based authenticatio... |
critical | 9.8 | — | Amazon / athena odbc | 2026-04-03 | 2026-10-20 |
| CVE-2026-110756 Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110757 Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing str... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.