October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93582 The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior... |
critical | 9.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validat... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks i... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63350 Affected devices do not properly restrict executable content contained in import... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported t... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109755 Sandbox escape in the DOM: Content Processes component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102946 joserfc is a Python library that provides an implementation of several JSON Obje... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2025-14141 A flaw has been found in UTT 进取 520W 1.7.7-180627. |
critical | 9.8 | — | Utt / 520w firmware | 2025-12-06 | 2026-10-15 |
| CVE-2026-110958 A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-83038 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.9 | — | Oracle / weblogic server | 2026-09-15 | 2026-10-15 |
| CVE-2025-14245 A vulnerability has been found in IdeaCMS up to 1.8. |
critical | 9.8 | — | Ideacms / ideacms | 2025-12-08 | 2026-10-15 |
| CVE-2025-61318 Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. |
critical | 9.1 | — | Emlog / emlog | 2025-12-08 | 2026-10-15 |
| CVE-2025-14306 A directory traversal vulnerability exists in the CacheCleaner component of Robo... |
critical | 9.1 | — | Robocode / robocode | 2025-12-09 | 2026-10-15 |
| CVE-2025-14308 An integer overflow vulnerability exists in the write method of the Buffer class... |
critical | 9.8 | — | Robocode / robocode | 2025-12-09 | 2026-10-15 |
| CVE-2026-59318 In Spring AI's tool calling support, the per-request tool list is advertised to... |
critical | 9.8 | — | Vmware / spring ai | 2026-08-21 | 2026-10-15 |
| CVE-2026-106620 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-88131 Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized... |
critical | 9.8 | — | Microsoft / dataverse | 2026-10-08 | 2026-10-15 |
| CVE-2026-96207 Improper certificate validation in Microsoft Partner Center allows an unauthoriz... |
critical | 10.0 | — | Microsoft / partner center | 2026-10-08 | 2026-10-15 |
| CVE-2026-106622 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106621 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106619 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
critical | 9.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106624 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2018-7489 FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x befor... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2018-02-26 | 2026-10-15 |
| CVE-2018-8014 The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to... |
critical | 9.8 | — | Apache / tomcat | 2018-05-16 | 2026-10-15 |
| CVE-2018-19857 The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may re... |
critical | 9.1 | — | Videolan / vlc media player | 2018-12-05 | 2026-10-15 |
| CVE-2018-19361 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-19362 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-19360 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-14721 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to cond... |
critical | 10.0 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2018-14720 FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct ext... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-15 |
| CVE-2026-19622 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass auth... |
critical | 9.8 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
| CVE-2026-97668 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92097 The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-19593 OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata... |
critical | 9.8 | — | — | 2026-09-01 | 2026-10-15 |
| CVE-2026-110002 The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108291 Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108587 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-104800 The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.