October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,597
Critical
3,298
High
7,978
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-16001 Exposure of the message authentication key through the encryption keystream in t... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63566 Memory allocation with excessive size value in the DTLS handshake reassembly (Dt... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63568 Allocation of resources without limits or throttling in the CMP/CRMF password-ba... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-116738 VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode funct... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116747 Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116843 Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that al... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117558 The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vu... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117559 DroidMind through 0.4.0 contains a command injection vulnerability that allows M... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117561 Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117567 esp-mcp through commit 28afddf contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117569 Kali-GPT through commit a608c74 contains an OS command injection vulnerability i... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117573 hagent through commit 761eec6 contains an OS command injection vulnerability tha... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an una... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-41021 Eaton easyE4 uses an insufficiently strong password policy. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117553 Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerabi... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117602 Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plu... |
high | 8.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-108458 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-116723 FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BM... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-108464 Use after free in Software Protection Platform (SPP) allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108467 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an auth... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-16521 An OS command injection vulnerability exists because of insufficient input filte... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-18449 The BMC does not correctly enforce integrity and encryption requirements for IPM... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65219 A flaw in the BMC RAKP+ implementation may allow an attacker to send a request f... |
high | 7.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65220 A logic flaw in the BMC IPMI implementation may allow an attacker to send specia... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-65211 This issue may allow an authenticated IPMI Administrator to read and write arbit... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-109453 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69577 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69789 Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allow... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-16513 The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-69802 Weak authentication in Network Device Enrollment Service (NDES) allows an unauth... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-27 |
| CVE-2026-18413 The ADC API requires each driver to reject a sampling sequence whose destination... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-18414 The ADC API requires each driver to reject a sampling sequence whose destination... |
high | 7.8 | — | Zephyrproject / zephyr | 2026-09-28 | 2026-10-27 |
| CVE-2026-83398 Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-28167 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-08-24 | 2026-10-27 |
| CVE-2026-117604 Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger:... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116818 OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vuln... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116620 A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116587 Go JOSE provides an implementation of the Javascript Object Signing and Encrypti... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-69986 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.