October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96512 A flaw was found in sudo. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-96275 A malicious or compromised Flatpak repository can write attacker-controlled cont... |
high | 8.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-83596 A flaw was found in WebKitGTK. |
high | 8.8 | — | — | 2026-08-31 | 2026-10-29 |
| CVE-2026-78376 A flaw was found in WebKitGTK. |
high | 8.8 | — | — | 2026-08-24 | 2026-10-29 |
| CVE-2026-72764 n8n's JavaScript task runner shared a single module cache across all users' Code... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72766 n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type... |
high | 7.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72767 n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remot... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72768 n8n versions before 2.32.1 contain a server-side request forgery protection bypa... |
high | 8.3 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72769 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerabi... |
high | 8.1 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65598 n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the... |
high | 7.5 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-72750 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability i... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72762 n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65595 n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued th... |
high | 8.8 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-65596 n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Reque... |
high | 8.1 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-42692 Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61988 Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61995 Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116868 Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118076 Contributor PHP Object Injection in Frisbii Pay |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118081 Contributor PHP Object Injection in 10Web Social Photo Feed |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116177 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vul... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116189 rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in sta... |
high | 7.5 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116149 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buff... |
high | 8.1 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116050 A vulnerability has been found in krupalshah Employee Recruitment System up to 9... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-108494 Unauthenticated Cross Site Scripting (XSS) in Chained Quiz |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107042 Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 a... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-102557 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-29 |
| CVE-2026-102558 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-29 |
| CVE-2026-102559 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-29 |
| CVE-2026-102556 A flaw was found in libsoup. |
high | 8.6 | — | Gnome / libsoup | 2026-09-29 | 2026-10-29 |
| CVE-2026-96108 Use after free in Desktop Window Manager allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-95943 Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83741 Use after free in Internet Explorer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83740 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83739 Use after free in Windows Bluetooth Service allows an unauthorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83738 Use after free in Windows Ancillary Function Driver for WinSock allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83725 Heap-based buffer overflow in Microsoft Windows Search Component allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83513 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83514 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83735 Release of invalid pointer or reference in Windows Kernel allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.