October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112712 @fastify/middie is the Express-style middleware engine for Fastify. |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-110186 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-104317 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could re... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-63912 In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp:... |
critical | 9.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-94265 When processing an HTTP redirect to a URL containing userinfo (a
`username:passw... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87095 Sensitive information disclosure and manipulation due to improper authorization... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-86249 On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_p... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-78334 Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-108771 Missing authentication for in-house broadcast and polymorphic deserialization vu... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-61707 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.0 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-61728 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61729 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.4 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61730 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 9.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-61738 SOCFortress CoPilot focuses on providing a single pane of glass for all your sec... |
critical | 10.0 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-37171 A lack of tenant separation in SuperTokens Inc. |
critical | 9.6 | — | Supertokens / supertokens | 2026-08-07 | 2026-10-30 |
| CVE-2025-66208 Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in... |
critical | 9.8 | — | Collabora / online | 2025-12-03 | 2026-10-30 |
| CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability |
critical | 9.8 | Listed | Collabora / Collabora Online – Built-in CODE Server | 2026-10-14 | 2026-10-30 |
| CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote r... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-46652 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-55486 The Goobi viewer is a web application that allows digitised material to be displ... |
critical | 9.3 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-119706 InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code e... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-110799 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-103039 The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in... |
critical | 9.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-91214 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91216 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 10.0 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91218 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.6 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91225 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.1 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91230 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.3 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91233 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91234 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91235 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91236 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-56388 The Redis server command parser in Apache bRPC accepts an empty RESP array as a... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-48830 Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenti... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-104339 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute a... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-18894 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger p... |
critical | 9.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-98549 In the Linux kernel, the following vulnerability has been resolved:
tcp: preven... |
critical | 9.1 | — | — | 2026-10-18 | 2026-10-30 |
| CVE-2026-98490 In the Linux kernel, the following vulnerability has been resolved:
net: openvs... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-30 |
| CVE-2026-93228 In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Re... |
critical | 9.1 | — | — | 2026-09-24 | 2026-10-30 |
| CVE-2026-92388 When an FTP wildcard `LIST` operation fails, libcurl omits the restoration
path... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.