October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,599
Critical
3,298
High
7,980
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101459 Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (compone... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-54453 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118753 FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerab... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118752 FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerab... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-0631 An OS Command Injection vulnerability exists in the Surfshark VPN login function... |
high | 8.0 | — | Tp-link / archer be230 firmware | 2026-02-02 | 2026-10-28 |
| CVE-2023-54404 Zod schema-validation library contains an uncontrolled resource consumption vuln... |
high | — | — | — | 2026-10-01 | 2026-10-28 |
| CVE-2026-93631 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Coll... |
high | 7.1 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-91272 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91267 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91268 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91269 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91270 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91271 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91259 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91260 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91266 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91242 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugin... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91252 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91253 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91256 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-70341 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.8 | — | Microsoft / edge | 2026-09-11 | 2026-10-28 |
| CVE-2026-70354 Out-of-bounds write in .NET allows an unauthorized attacker to execute code loca... |
high | 7.8 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62886 Integer overflow or wraparound in .NET allows an unauthorized attacker to elevat... |
high | 7.8 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62898 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
high | 7.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62871 Out-of-bounds write in .NET allows an unauthorized attacker to execute code loca... |
high | 7.8 | — | Microsoft / .net | 2026-08-11 | 2026-10-28 |
| CVE-2026-62752 Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
| CVE-2026-55103 Discourse ActivityPub adds ActivityPub support to Discourse. |
high | 8.6 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-100208 Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorize... |
high | 8.1 | — | Microsoft / 365 apps | 2026-09-25 | 2026-10-28 |
| CVE-2026-85933 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85934 Use after free in Windows AppX Deployment Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85936 Double free in Windows Shell allows an unauthorized attacker to execute code ove... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85941 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85945 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87691 Use after free in Windows Management Services allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-101450 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-87693 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87700 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87702 Integer overflow or wraparound in Windows Resource Management (MRM) allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87704 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87705 Improper verification of source of a communication channel in Windows Hyper-V al... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.