October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83568 Improper access control in Windows Kernel-Mode Drivers allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83567 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83566 Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. |
high | 8.8 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-28 |
| CVE-2026-96644 Pillow is a Python imaging library. |
high | 8.1 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-91342 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91346 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91347 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Ser... |
high | 8.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91348 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91321 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91325 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91340 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91315 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91316 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-61726 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-118688 wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 befor... |
high | 7.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118686 EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulner... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118679 n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery v... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118647 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTa... |
high | 8.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118648 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stor... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulne... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118676 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118643 n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credenti... |
high | 8.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118644 n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execu... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vuln... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI lo... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114440 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114138 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2018-25438 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path trave... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-88152 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability |
high | 8.8 | Listed | Apple / Multiple Products | 2025-11-05 | 2026-10-28 |
| CVE-2023-22839 On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before... |
high | 7.5 | — | F5 / big-ip domain name system | 2023-02-01 | 2026-10-28 |
| CVE-2023-0698 Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a r... |
high | 8.8 | — | Google / chrome | 2023-02-07 | 2026-10-28 |
| CVE-2023-0251 Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buff... |
high | 7.8 | — | Deltaww / diascreen | 2023-02-08 | 2026-10-28 |
| CVE-2023-23783 A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0... |
high | 7.8 | — | Fortinet / fortiweb | 2023-02-16 | 2026-10-28 |
| CVE-2023-22234 Adobe Premiere Rush version 2.6 (and earlier) is affected by a Stack-based Buffe... |
high | 7.8 | — | Adobe / premiere rush | 2023-02-17 | 2026-10-28 |
| CVE-2023-22789 Multiple authenticated command injection vulnerabilities exist in the Aruba Inst... |
high | 8.8 | — | Arubanetworks / arubaos | 2023-05-08 | 2026-10-28 |
| CVE-2023-29154 SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions pr... |
high | 7.2 | — | Contec / conprosys hmi system | 2023-06-01 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.