October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,598
Critical
3,298
High
7,980
Medium
7,645
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118307 Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-33923 A signature verification vulnerability was discovered in the update installation... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installat... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118311 Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-118313 Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-29 |
| CVE-2026-5201 A flaw was found in the gdk-pixbuf library. |
high | 7.5 | — | Gnome / gdk-pixbuf | 2026-03-31 | 2026-10-29 |
| CVE-2026-86949 This issue was addressed by enforcing library validation on the affected binarie... |
high | 8.8 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-61571 AVideo is a video-sharing Platform. |
high | 7.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103665 The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85867 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85868 Use after free in Windows Common Log File System Driver allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85869 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85870 Heap-based buffer overflow in Windows Common Log File System Driver allows an au... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85871 Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85872 Use after free in Windows Storage VSP Driver allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allo... |
high | 7.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-100105 A user with permission to edit contact points but not their protected fields can... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88967 A user with query access to an Azure Monitor data source in Grafana can cause se... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83652 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-111417 A broken access control vulnerability exists in the Foxit official website’s HTM... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111418 A server-side request forgery (SSRF) vulnerability exists in the Foxit official... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official webs... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118602 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118603 Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118605 Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118606 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Executi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118610 Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Exe... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118613 Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118614 Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118615 Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerabilit... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118616 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118617 Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Cod... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118618 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118619 Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerabi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111739 The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Securit... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115301 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox th... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86794 The Community Events WordPress plugin before 1.6.0 does not have authorisation o... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-89216 The vTables WordPress plugin before 0.3 does not properly sanitise and escape a... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86016 VNote is a note-taking platform. |
high | 8.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-115810 Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerabilit... |
high | 7.7 | — | — | 2026-10-23 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.