October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-37524 HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due... |
high | 7.8 | — | Hcltech / traveler for microsoft outlook | 2026-06-27 | 2026-10-28 |
| CVE-2023-54366 SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, a... |
high | 8.8 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-28 |
| CVE-2026-118345 Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-27 | 2026-10-28 |
| CVE-2023-52356 A segment fault (SEGV) flaw was found in libtiff that could be triggered by pass... |
high | 7.5 | — | Debian / debian linux | 2024-01-25 | 2026-10-28 |
| CVE-2026-98096 In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: r... |
high | 7.4 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-98112 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-98111 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-98110 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-96626 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-91343 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91353 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91355 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91358 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91337 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91338 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Int... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91326 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91327 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91328 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplie... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114259 A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114262 A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111577 The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111021 The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105972 The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise an... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102834 JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2017-20287 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-78459 Heap-based buffer overflow in Windows Internet Information Services allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83511 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63952 In the Linux kernel, the following vulnerability has been resolved:
memfd: deny... |
high | 8.4 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-77496 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63946 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-72969 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85339 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72968 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85341 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72955 Use after free in Windows Application Compatibility Cache allows an authorized a... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85342 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72934 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85343 Improper link resolution before file access ('link following') in Windows Hyper-... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.