October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87301 Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (comp... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83826 Untrusted pointer dereference in Windows Error Reporting allows an authorized at... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83827 Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83828 Heap-based buffer overflow in Windows MIDI Service Module allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83829 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83830 Heap-based buffer overflow in Windows COM+ Event System Service allows an author... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83832 Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83833 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-106117 ImageSharp is a 2D graphics library. |
high | 7.5 | — | Sixlabors / imagesharp | 2026-10-06 | 2026-10-27 |
| CVE-2026-83834 Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83836 Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83837 Improper access control in Windows Kernel-Mode Drivers allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83838 Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows a... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-106437 The BSON buffer-reservation API in the MongoDB C Driver can record a length smal... |
high | 7.4 | — | Mongodb / c driver | 2026-10-08 | 2026-10-27 |
| CVE-2026-83839 Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83840 Weak authentication in Windows Error Reporting allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-83841 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-27 |
| CVE-2026-87296 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83403 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83404 Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connec... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83407 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83409 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83426 Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-87263 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83402 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-110247 Several buffer-growth sites in libmime performed size arithmetic in 32-bit types... |
high | 8.4 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-100801 Privilege escalation in the DLL Services component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-27 |
| CVE-2024-58390 Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege man... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-27 |
| CVE-2024-22031 A vulnerability has been identified within Rancher where a user with the ability... |
high | 8.5 | — | — | 2026-10-15 | 2026-10-27 |
| CVE-2024-58396 YouDataSum CPAS Audit Management System V4 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2024-55045 Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffe... |
high | 7.3 | — | — | 2026-05-13 | 2026-10-27 |
| CVE-2026-109257 FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initia... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-105007 An elevation of privilege vulnerability exists in the Network Driver Interface S... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-102675 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | Electronjs / electron | 2026-09-29 | 2026-10-27 |
| CVE-2026-101388 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101390 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2024-14047 A local vulnerability in the Winlogbeat Windows installer caused runtime files t... |
high | 7.1 | — | Elastic / winlogbeat | 2026-09-01 | 2026-10-27 |
| CVE-2024-35585 Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for... |
high | 8.6 | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2024-58381 PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginP... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-27 |
| CVE-2024-58382 league/commonmark versions before 2.6.0 contain polynomial time complexity vulne... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.