October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116094 A vulnerability was determined in EyouCMS up to 1.8.3. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116106 A security vulnerability has been detected in HeyCyan App 1.0.103 on Android. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-116112 A vulnerability was identified in HashenUdara edoc-doctor-appointment-system up... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-114476 Incorrect authorization in the REST administration API of Progressive Robot hMai... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114489 Missing authorization in the REST and COM administration APIs of Progressive Rob... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-114490 Incorrect authorization in the COM administration API of Progressive Robot hMail... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-116061 A vulnerability was identified in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-107091 An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a loc... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-107020 An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107026 Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unaut... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107037 Insecure permissions in the NotificationHelper component of NoNonsense Notes ver... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105208 ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with... |
high | 7.7 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105210 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio... |
high | 8.2 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105212 ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypas... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-104085 odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerabi... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-102486 Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-104591 libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_paylo... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-104596 libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplem... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-102483 Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to te... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-100709 Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (p... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-29 |
| CVE-2025-71398 SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allow... |
high | 7.6 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-34509 Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 1... |
high | 7.5 | — | Sitecore / experience commerce | 2025-06-17 | 2026-10-29 |
| CVE-2025-34506 WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution... |
high | 8.8 | — | Wbce / wbce cms | 2025-12-11 | 2026-10-29 |
| CVE-2025-71392 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to prop... |
high | 8.0 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2024-58366 SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Ex... |
high | 8.8 | — | Delskayn / rquickjs | 2026-07-18 | 2026-10-29 |
| CVE-2025-15620 HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.0... |
high | 8.6 | — | Belden / hios switch | 2026-04-02 | 2026-10-29 |
| CVE-2023-53937 Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability th... |
high | 7.8 | — | Hubstaff / hubstaff | 2025-12-18 | 2026-10-29 |
| CVE-2023-53982 PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the stor... |
high | 7.5 | — | Sigb / pmb | 2025-12-23 | 2026-10-29 |
| CVE-2017-20238 Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and... |
high | 7.1 | — | — | 2026-04-03 | 2026-10-29 |
| CVE-2018-25308 BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion... |
high | 8.8 | — | — | 2026-04-29 | 2026-10-29 |
| CVE-2017-20243 WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQ... |
high | 8.2 | — | — | 2026-06-09 | 2026-10-29 |
| CVE-2016-20084 WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escala... |
high | 7.2 | — | — | 2026-06-15 | 2026-10-29 |
| CVE-2026-69966 Integer overflow or wraparound in Microsoft Streaming Service allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70198 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83666 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83670 Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83674 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83688 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83694 Out-of-bounds read in Windows Volume Manager Extension Driver allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-89059 A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied... |
high | 7.5 | — | — | 2026-09-18 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.