October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-32557 Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-29 |
| CVE-2026-57116 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-48360 Adobe Connect is affected by an Improper Control of Generation of Code ('Code In... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-115384 Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer o... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-114611 OCO-Server is a self-hosted endpoint management application for computer invento... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51026 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability tha... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2021-48016 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMs... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-84999 The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115806 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP... |
critical | 9.8 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-106013 The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass v... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109218 The Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2025-65200 An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitr... |
critical | 9.6 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-91243 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
critical | 9.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91250 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91251 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91241 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-9659 Multiple exploitable stack-based buffer overflow vulnerabilities exist in the bo... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-55240 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-47304 Improper verification of cryptographic signature in .NET allows an unauthorized... |
critical | 9.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-40627 An os command injection vulnerability exists in the boa formWsc targetAPSsid fun... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41222 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-41223 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice m... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42019 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-42020 Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Se... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-40615 A stack-based buffer overflow vulnerability exists in the boa formParentControl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-28763 A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice h... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-33568 A OS command injection vulnerability exists in the boa formMapDelDevice macstr f... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-104286 Fortinet FortiMail Path Traversal Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiMail | 2026-10-01 | 2026-10-28 |
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-91341 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-57169 Dockhand is a Docker management application. |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114268 A flaw has been found in Tenda BE3L Pro 16.03.60.62. |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114383 A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2023-0758 A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical... |
critical | 9.8 | — | Jfinaloa Project / jfinaloa | 2023-02-09 | 2026-10-28 |
| CVE-2023-0745 The High Availability functionality of Yugabyte Anywhere can be abused to write... |
critical | 9.8 | — | Yugabyte / yugabytedb managed | 2023-02-09 | 2026-10-28 |
| CVE-2023-1357 A vulnerability, which was classified as critical, has been found in SourceCodes... |
critical | 9.8 | — | Simple Bakery Shop Management System Project / simple bakery shop management system | 2023-03-12 | 2026-10-28 |
| CVE-2023-54203 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
critical | 9.1 | — | — | 2025-12-30 | 2026-10-28 |
| CVE-2023-54223 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2025-12-30 | 2026-10-28 |
| CVE-2023-54342 Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution v... |
critical | 9.8 | — | — | 2026-05-05 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.