October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,598
Critical
3,298
High
7,980
Medium
7,645
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70109 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83759 Improper control of generation of code ('code injection') in Windows Encrypting... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85318 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83762 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83763 Access of resource using incompatible type ('type confusion') in Windows Input S... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85319 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83518 Heap-based buffer overflow in RPC Runtime allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83515 Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
high | 7.1 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-85321 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83564 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85828 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83767 Stack-based buffer overflow in Windows Installer allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83769 Use after free in OpenSSH for Windows allows an authorized attacker to elevate p... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-46300 In the Linux kernel, the following vulnerability has been resolved:
net: skbuff... |
high | 7.8 | Listed | Linux / linux kernel | 2026-05-23 | 2026-10-29 |
| CVE-2026-91213 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-91215 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-84387 A improper neutralization of special elements used in a command ('command inject... |
high | 7.2 | — | — | 2026-09-08 | 2026-10-29 |
| CVE-2026-39736 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116399 Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect insta... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116174 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116062 A security flaw has been discovered in SourceCodester Performance Indicator Syst... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116098 A vulnerability was detected in SteelRaven7 Ravenfield 25407073. |
high | 7.8 | — | Steelraven7 / ravenfield | 2026-10-26 | 2026-10-29 |
| CVE-2026-116014 open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStr... |
high | 8.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecti... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffer... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking chan... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retai... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-107618 `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that... |
high | 8.1 | — | — | 2026-10-18 | 2026-10-29 |
| CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encodi... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-91798 A local privilege escalation vulnerability exists in the update daemon of Foxit... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91794 An out-of-bounds write vulnerability exists in the PDF rendering process of Foxi... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-83784 Absolute path traversal in Windows Encrypting File System (EFS) allows an author... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-101421 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-29 |
| CVE-2026-101772 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-29 |
| CVE-2026-101773 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-29 |
| CVE-2026-84294 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Sof... |
high | 7.7 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.