October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107237 The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does n... |
high | 8.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107506 The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the cap... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-102499 The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Cal... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-82814 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Ob... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114106 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114107 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114097 Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in Comm... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114098 Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stas... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114102 adm-zip before 0.6.1 contains a denial of service vulnerability that allows unau... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114094 Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114096 Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in p... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the... |
high | 7.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114087 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the defaul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114090 Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vul... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114078 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in Delet... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL que... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114082 Trigger.dev before 4.6.2 contains an authorization vulnerability that allows pub... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114083 Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtim... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114077 Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in creat... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that all... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114068 Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the w... |
high | 8.3 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114069 Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114063 SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vul... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-27 |
| CVE-2026-114053 vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.... |
high | 8.1 | — | Vllm / vllm | 2026-10-21 | 2026-11-03 |
| CVE-2026-114055 vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vuln... |
high | 7.5 | — | Vllm / vllm | 2026-10-21 | 2026-11-03 |
| CVE-2026-114059 ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allo... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114050 vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache iden... |
high | 7.5 | — | Vllm / vllm | 2026-10-21 | 2026-11-03 |
| CVE-2026-114051 vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/ge... |
high | 7.5 | — | Vllm / vllm | 2026-10-21 | 2026-11-03 |
| CVE-2026-114052 vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability i... |
high | 7.5 | — | Vllm / vllm | 2026-10-21 | 2026-11-03 |
| CVE-2026-114045 FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side r... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2021-48018 Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentr... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-91668 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
high | 8.8 | — | Oracle / data integrator | 2026-10-20 | 2026-11-03 |
| CVE-2026-93441 IBM QRadar SIEM could allow a remote attacker to cause a denial of service due t... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-93442 IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-93888 IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-91659 Vulnerability in Oracle Essbase (component: Build). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-91661 Vulnerability in Oracle Essbase (component: Security). |
high | 7.7 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.