October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-54344 Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerab... |
critical | 9.8 | — | — | 2026-05-05 | 2026-10-28 |
| CVE-2023-46453 Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting... |
critical | 9.8 | — | — | 2026-05-08 | 2026-10-28 |
| CVE-2023-24215 Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware... |
critical | 9.1 | — | — | 2026-05-18 | 2026-10-28 |
| CVE-2026-63939 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: C... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-91354 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-39795 Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-28 |
| CVE-2026-103688 The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-70153 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70147 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-74990 Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74989 Internally found bugs present in Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74988 Internally found bugs present in Firefox ESR 153.0 and Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74987 Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firef... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-117564 nest-admin before 1.0.1 contains an authentication bypass vulnerability that all... |
critical | 9.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-70275 Untrusted pointer dereference in Windows CD-ROM Driver allows an unauthorized at... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-114119 Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft... |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113744 A security vulnerability has been detected in Tenda AC19 16.03.10.07. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-104354 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103409 A Missing authentication for critical function vulnerability in Juniper Networks... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103406 An Improper Neutralization of Special Elements used in an OS Command vulnerabili... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-70157 Heap-based buffer overflow in Windows System Information Console allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96864 Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85928 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81212 IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to pe... |
critical | 10.0 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-115968 Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Memb... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113736 A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. |
critical | 9.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111411 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111057 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 10.0 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2026-115915 vLLM is an inference and serving engine for large language models. |
critical | 9.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-114278 The che-machine-exec service constructs a shell command by concatenating user-co... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118477 The ei_git_repo_url parameter in the Git remote configuration endpoint of KaliFa... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110879 jackson-databind validates the outer class of a class-name type ID but accepts a... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87347 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com... |
critical | 9.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-105489 Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Specia... |
critical | 9.9 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-56563 A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Sa... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-28 |
| CVE-2026-67074 HCL BigFix AEX is affected by a Remote Code Execution Vulnerability . |
critical | 9.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-48356 Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type... |
critical | 9.3 | Listed | Adobe / commerce | 2026-07-14 | 2026-10-28 |
| CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a se... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.