October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110680 Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds whe... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-110681 Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scal... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2024-9287 A vulnerability has been found in the CPython `venv` module and CLI where path n... |
high | 7.8 | — | Python / python | 2024-10-22 | 2026-10-30 |
| CVE-2026-76418 A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Ad... |
high | 8.6 | Listed | Cisco / adaptive security appliance software | 2026-10-28 | 2026-10-30 |
| CVE-2026-101295 Path traversal / arbitrary file write in oc-mirror's operator catalog image extr... |
high | 7.3 | — | — | 2026-09-30 | 2026-10-30 |
| CVE-2026-5260 A flaw was found in libgnutls. |
high | 8.2 | — | — | 2026-05-26 | 2026-10-30 |
| CVE-2026-58014 A flaw was found in GLib. |
high | 8.6 | — | Gnome / glib | 2026-06-30 | 2026-10-30 |
| CVE-2026-58015 A flaw was found in GLib. |
high | 7.5 | — | Gnome / glib | 2026-06-30 | 2026-10-30 |
| CVE-2026-42013 A flaw was found in gnutls. |
high | 8.2 | — | — | 2026-05-26 | 2026-10-30 |
| CVE-2026-42011 A flaw was found in gnutls. |
high | 7.4 | — | — | 2026-05-07 | 2026-10-30 |
| CVE-2026-42012 A flaw was found in gnutls. |
high | 7.1 | — | — | 2026-05-26 | 2026-10-30 |
| CVE-2026-71226 Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO... |
high | 7.3 | — | Redhat / hardened images | 2026-08-05 | 2026-10-30 |
| CVE-2026-12080 A flaw was found in the QEMU Guest Agent (qga). |
high | 7.3 | — | — | 2026-07-20 | 2026-10-30 |
| CVE-2026-94640 A flaw was found in rpcbind. |
high | 7.5 | — | — | 2026-09-22 | 2026-10-30 |
| CVE-2026-93017 The `insights-operator-gather` ClusterRole grants the operator's service account... |
high | 7.7 | — | — | 2026-10-08 | 2026-10-30 |
| CVE-2026-49329 A flaw was found in openshift/oauth-server. |
high | 7.5 | — | — | 2026-09-01 | 2026-10-30 |
| CVE-2026-92574 A vulnerability in CRI-O checkpoint restore allows a user who can create a pod f... |
high | 8.8 | — | — | 2026-09-21 | 2026-10-30 |
| CVE-2026-75888 A flaw was found in the OpenShift console. |
high | 7.7 | — | — | 2026-10-12 | 2026-10-30 |
| CVE-2026-109411 An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's o... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-104795 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-103963 A flaw was found in glib-networking. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-93851 Mattermost versions 11.9.x |
high | 8.0 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-96196 Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows a... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96198 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96199 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-96203 Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacke... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-92982 A flaw was found in Ansible Operator Plugins. |
high | 8.5 | — | — | 2026-10-15 | 2026-10-30 |
| CVE-2026-90867 Improper access control in the Web Admin console of Progress Software WS_FTP Ser... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-88077 Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unau... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-86398 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86399 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86395 Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86396 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86389 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86393 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86394 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-85890 Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker t... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85897 Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthor... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85899 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-43961 A flaw was found in Vim's netrw plugin. |
high | 7.8 | — | — | 2026-08-19 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.