October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,596
Critical
3,297
High
7,980
Medium
7,645
Low
740
Severity not reported
4,934
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83916 Double free in Windows Error Reporting allows an authorized attacker to execute... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83917 Use after free in Windows ALPC allows an authorized attacker to elevate privileg... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91229 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91226 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91227 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-87743 A flaw was found in Quarkus HTTP security. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-29 |
| CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86977 An authorization issue was addressed with improved network restrictions. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86467 Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-80353 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-61993 Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnera... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-54866 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54455 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-34485 Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability w... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authe... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authoriz... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118804 Bricks Builder 2.4.3 and before contains a broken access control vulnerability t... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in th... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83647 Out-of-bounds read in Active Directory Domain Services allows an unauthorized at... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that a... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118755 Volmarg Personal Management System through 2.1.0 contains an OS command injectio... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118660 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118075 Contributor PHP Object Injection in WP Media folders |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118080 Contributor PHP Object Injection in Social Snap |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116867 Contributor PHP Object Injection in Dynamic QR Code – generator |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114621 baserCMS is a website development framework. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string ke... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-108088 ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83918 Integer overflow or wraparound in Windows Kernel allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83919 Heap-based buffer overflow in Microsoft Internet Messaging API allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83920 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83921 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83922 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83569 Heap-based buffer overflow in HID Parser Library allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70110 Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an una... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70109 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.