October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-36342 Improper input validation in the GPU driver could allow an attacker to exploit a... |
high | 8.8 | — | — | 2025-09-06 | 2026-10-27 |
| CVE-2024-58287 reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd paramet... |
high | 8.8 | — | Yogeshojha / rengine | 2025-12-11 | 2026-10-27 |
| CVE-2024-58294 FreePBX 16 contains an authenticated remote code execution vulnerability in the... |
high | 8.8 | — | Sangoma / freepbx | 2025-12-11 | 2026-10-27 |
| CVE-2024-58307 CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the member... |
high | 8.8 | — | Cszcms / csz cms | 2025-12-11 | 2026-10-27 |
| CVE-2024-58312 xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticat... |
high | 7.5 | — | Xbtitfm / xbtitfm | 2025-12-11 | 2026-10-27 |
| CVE-2024-58313 xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authen... |
high | 7.2 | — | Xbtitfm / xbtitfm | 2025-12-11 | 2026-10-27 |
| CVE-2024-58305 WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attack... |
high | 8.8 | — | — | 2025-12-12 | 2026-10-27 |
| CVE-2024-44598 FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. |
high | 8.8 | — | Fntsoftware / fnt command | 2025-12-15 | 2026-10-27 |
| CVE-2024-44599 FNT Command 13.4.0 is vulnerable to Directory Traversal. |
high | 8.3 | — | Fntsoftware / fnt command | 2025-12-15 | 2026-10-27 |
| CVE-2024-29371 In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) conditio... |
high | 7.5 | — | Jose4j Project / jose4j | 2025-12-17 | 2026-10-27 |
| CVE-2024-46062 Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalatio... |
high | 7.8 | — | Conda / miniconda3 | 2025-12-17 | 2026-10-27 |
| CVE-2024-24844 Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Eleme... |
high | 7.5 | — | — | 2025-12-23 | 2026-10-27 |
| CVE-2024-9684 FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a... |
high | 7.5 | — | — | 2025-12-23 | 2026-10-27 |
| CVE-2024-30855 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulne... |
high | 8.8 | — | Dedecms / dedecms | 2025-12-29 | 2026-10-27 |
| CVE-2024-25183 givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. |
high | 7.5 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-43384 A low privileged remote attacker can gain the root password due to improper remo... |
high | 8.0 | — | Phoenixcontact / fl mguard 2102 firmware | 2026-05-07 | 2026-10-27 |
| CVE-2024-36333 A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker... |
high | 7.8 | — | Amd / radeon software | 2026-05-15 | 2026-10-27 |
| CVE-2024-32386 Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v... |
high | 7.3 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-34268 EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the late... |
high | 7.1 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-58362 SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary... |
high | 8.8 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58368 SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS header... |
high | 7.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-51316 The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the... |
high | 7.5 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2026-64239 In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sy... |
high | 7.8 | — | Linux / linux kernel | 2026-07-24 | 2026-10-27 |
| CVE-2024-6832 The account locking mechanism fails to trigger when secondary user stores are in... |
high | 7.5 | — | Wso2 / api control plane | 2026-08-06 | 2026-10-27 |
| CVE-2024-39024 In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote... |
high | 8.8 | — | — | 2026-08-06 | 2026-10-27 |
| CVE-2026-101411 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101416 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101428 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101429 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.0 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-103555 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103575 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103577 Insecure default variable initialization in Microsoft QUIC allows an unauthorize... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-105003 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-109431 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing autho... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-87694 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-87695 Inclusion of functionality from untrusted control sphere in Microsoft Exchange S... |
high | 7.8 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
| CVE-2026-87696 Improper verification of cryptographic signature in Microsoft Exchange Server al... |
high | 7.5 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
| CVE-2026-87699 Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-15999 Improper validation of integrity check value in the AES-CCM implementation (CcmP... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-16000 Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCi... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.