October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70051 Access of resource using incompatible type ('type confusion') in Windows SmartSc... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70052 Integer overflow or wraparound in Windows PowerShell allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70054 Heap-based buffer overflow in Windows NetBIOS allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70056 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70058 Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to ex... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70059 Heap-based buffer overflow in Windows OLE allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70060 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70062 Double free in Windows Libarchive allows an unauthorized attacker to execute cod... |
high | 8.1 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70064 Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70066 Use after free in Windows DHCP Server allows an authorized attacker to elevate p... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70067 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70068 Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70069 Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70076 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70086 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70089 Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59185 identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kube... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-56828 Shopper is a Headless e-commerce Admin Panel. |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114094 Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-115596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115612 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116393 Missing Authorization vulnerability in iHomefinder, Inc. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL que... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtim... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114059 ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allo... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that all... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114069 Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114051 vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/ge... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112399 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112404 Pillow is a Python imaging library. |
high | 8.2 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112893 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112395 Pillow is a Python imaging library. |
high | 8.2 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111044 Sunshine is a self-hosted game stream host for Moonlight. |
high | 7.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2016-20103 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-98116 In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-105733 Improper access control in Windows Hyper-V allows an authorized attacker to exec... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-98117 In the Linux kernel, the following vulnerability has been resolved:
cachefiles:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.