October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-74946 Information disclosure due to incorrect boundary conditions in the Graphics: Can... |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57186 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117609 rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in pr... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117601 Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in uncon... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117568 mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that all... |
high | 7.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117560 ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnera... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117515 A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117512 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116690 MLflow is an open source AI engineering platform for agents, large language mode... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114256 A weakness has been identified in oretnom23 file-management-system-php up to 2e3... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114243 A security flaw has been discovered in dhikshitha29 Insurance-Management-System... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114109 uv before 0.11.15 contains a path traversal vulnerability that allows malicious... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112353 GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-s... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-111758 markdown-it is a Markdown parser. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-111255 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109999 The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109381 The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation i... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-106079 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103411 An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Ses... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103408 A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Ses... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103407 An Improper Limitation of a Pathname to a Restricted Directory vulnerability in... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103403 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103401 An Improper Link Resolution Before File Access ('Link Following') vulnerability... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Junip... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2015-20125 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2012-20002 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path trav... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-70126 Out-of-bounds read in Windows Bluetooth Port Driver allows an unauthorized attac... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70131 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70274 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70132 Heap-based buffer overflow in Windows Portable Device File System Driver allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70133 Allocation of resources without limits or throttling in Windows SMB Server allow... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70134 Use after free in Windows Event Tracing allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70136 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70006 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70138 Heap-based buffer overflow in Windows OLE allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70139 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70140 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.