October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70163 Allocation of resources without limits or throttling in OpenSSH for Windows allo... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63571 Improper verification of cryptographic signature in the attribute certificate pa... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63572 Allocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-87322 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-63573 Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTrans... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-70164 Use after free in Windows TCP/IP allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70168 Use after free in Windows Ancillary Function Driver for WinSock allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63574 Memory allocation with excessive size value in the OpenPGP signature and user at... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-70169 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70172 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70177 Numeric truncation error in Microsoft Windows Search Component allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70184 Improper resolution of path equivalence in Windows Backup Engine allows an autho... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70185 Protection mechanism failure in Windows PowerShell allows an authorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70205 Access of resource using incompatible type ('type confusion') in Windows Ancilla... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87316 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87315 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87314 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87313 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87312 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87310 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87309 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2024-27686 Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote atta... |
high | 7.5 | — | — | 2026-05-08 | 2026-10-28 |
| CVE-2024-33288 Prison Management System Using PHP v1.0 was discovered to contain a SQL injectio... |
high | 7.3 | — | — | 2026-05-08 | 2026-10-28 |
| CVE-2024-45257 A Command Injection issue in the payload build page in BYOB (Build Your Own Botn... |
high | 7.3 | — | — | 2026-05-08 | 2026-10-28 |
| CVE-2024-46507 A SSTI (server side template injection) vulnerability in the custom template exp... |
high | 7.3 | — | Yeti-platform / yeti | 2026-05-08 | 2026-10-28 |
| CVE-2026-118008 Privilege escalation in the DOM: Navigation component. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118378 Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite dr... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a s... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114577 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114636 Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernet... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114640 Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114661 OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in... |
high | 8.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-96778 Pillow is a Python imaging library. |
high | 8.8 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-89035 MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability i... |
high | 7.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-29001 TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that all... |
high | 7.2 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-96640 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-114439 A vulnerability was determined in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114267 A vulnerability was detected in SourceCodester Food Order Management System 1.0. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114255 A security flaw has been discovered in oretnom23 file-management-system-php up t... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114258 A vulnerability was detected in oretnom23 file-management-system-php up to 2e3c1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.