October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. |
high | 7.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116656 Tanium addressed an uncontrolled resource consumption vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116662 Tanium addressed a compression bomb vulnerability in Enforce. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-87086 Tanium addressed a denial of service vulnerability in Provision. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-88812 A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland b... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-110540 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115413 Missing token audience validation in the OAuth authentication mode of AWS API MC... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-66974 An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Applic... |
high | 7.5 | — | — | 2026-09-15 | 2026-10-28 |
| CVE-2025-66969 Integer overflow in OpenModSim (<=1.11.0), leading to denial of service |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-71436 Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-31699 Apache Traffic Server can return an origin connection to the shared pool while t... |
high | 8.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-55702 When a client sends a POST with Expect: 100-continue and the origin answers befo... |
high | 8.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-71434 Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2025-61479 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1... |
high | 7.5 | — | — | 2026-08-26 | 2026-10-28 |
| CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1... |
high | 7.5 | — | — | 2026-08-26 | 2026-10-28 |
| CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Co... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-63947 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-108130 Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclav... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108133 Release of invalid pointer or reference in Windows Modern Device Management (MDM... |
high | 7.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-28 |
| CVE-2026-117511 A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117513 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117514 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117516 A weakness has been identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108134 Use after free in Windows Autopilot allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108399 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 7.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69650 Improper verification of cryptographic signature in Windows Key Distribution Cen... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69743 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69763 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-103603 Memory allocation with excessive size value in the HSS/LMS signature code (HssPu... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103604 Inefficient algorithmic complexity in X.509 distinguished name string conversion... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63570 Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legio... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-70142 Untrusted search path in Windows Update Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70143 Heap-based buffer overflow in Windows Network File System allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.