October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93639 A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-91310 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91311 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91313 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91314 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91304 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91306 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91307 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91308 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91295 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91296 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91286 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91287 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91288 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91273 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-69414 Microsoft is aware of an elevation of privilege in the Microsoft Malware Protect... |
high | 7.8 | — | Microsoft / malware protection engine | 2026-08-14 | 2026-10-28 |
| CVE-2026-68807 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-08-11 | 2026-10-28 |
| CVE-2026-62897 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker... |
high | 7.0 | — | Microsoft / .net framework | 2026-08-11 | 2026-10-28 |
| CVE-2026-62901 Unchecked input for loop condition in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62909 Uncaught exception in .NET allows an authorized attacker to elevate privileges l... |
high | 7.8 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62877 Stack-based buffer overflow in Windows Win32K allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
| CVE-2026-57108 Access of resource using incompatible type ('type confusion') in .NET Core allow... |
high | 7.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-56170 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-55587 AliasVault is a privacy-first password manager with built-in email aliasing. |
high | 8.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-50651 Allocation of resources without limits or throttling in .NET allows an unauthori... |
high | 7.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-50528 Incorrect authorization in .NET allows an unauthorized attacker to bypass a secu... |
high | 8.2 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-50646 Protection mechanism failure in .NET Framework allows an unauthorized attacker t... |
high | 7.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50648 Allocation of resources without limits or throttling in .NET Framework allows an... |
high | 7.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50649 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 7.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50650 Improper control of generation of code ('code injection') in .NET Framework allo... |
high | 7.8 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50524 Improper validation of specified type of input in .NET Framework allows an unaut... |
high | 7.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-50525 Allocation of resources without limits or throttling in .NET allows an unauthori... |
high | 7.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50527 Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50053 A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) a... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-47302 Allocation of resources without limits or throttling in .NET allows an unauthori... |
high | 7.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-47303 Authentication bypass by assumed-immutable data in ASP.NET Core allows an author... |
high | 8.8 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-47300 Incorrect implementation of authentication algorithm in ASP.NET Core allows an a... |
high | 8.8 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-17615 A flaw was found in RESTEasy's SourceProvider. |
high | 7.5 | — | — | 2026-08-31 | 2026-10-28 |
| CVE-2026-13451 A flaw was found in KServe. |
high | 7.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112407 Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serve... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.