October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63950 In the Linux kernel, the following vulnerability has been resolved:
mm/rmap: in... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-91217 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.6 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91219 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.6 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91228 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.1 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91237 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91238 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.1 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91239 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-114396 Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability... |
high | 7.1 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114397 Trudesk through 1.2.11 contains a missing authentication vulnerability in debug... |
high | 7.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-101781 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.8 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-101771 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-59229 The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SU... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61902 Apache bRPC versions before 1.18.0 do not consistently enforce the configured ma... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54426 Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54427 Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56387 The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-58064 The Redis protocol implementation in Apache bRPC allowed inline command parsing... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54425 Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119572 Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerab... |
high | 8.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to e... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-101770 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-113947 This issue was addressed with improved access restrictions. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-30 |
| CVE-2026-106634 Adobe Experience Manager is affected by an Improper Limitation of a Pathname to... |
high | 7.7 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-103092 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-83699 Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-104328 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-107328 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110193 IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-p... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-110309 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-99081 In the Linux kernel, the following vulnerability has been resolved:
bnxt_en: fi... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99082 In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: U... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99083 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99077 In the Linux kernel, the following vulnerability has been resolved:
ipv4: udp:... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99054 In the Linux kernel, the following vulnerability has been resolved:
tipc: destr... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99056 In the Linux kernel, the following vulnerability has been resolved:
strparser:... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99059 In the Linux kernel, the following vulnerability has been resolved:
wireguard:... |
high | 7.7 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99053 In the Linux kernel, the following vulnerability has been resolved:
tipc: hold... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99032 In the Linux kernel, the following vulnerability has been resolved:
net/smc: pr... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-30 |
| CVE-2026-99012 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.