October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91511 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91512 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-69830 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69840 Use after free in Windows Certificates allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-33521 There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116368 A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115728 @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of se... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115908 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115909 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115347 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerabilit... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115349 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of ser... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-110205 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-26 |
| CVE-2026-109782 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109783 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that all... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109428 Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-107084 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site requ... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-26 |
| CVE-2026-105608 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105626 HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-69850 Untrusted pointer dereference in Windows Certificates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2014-125135 A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-69856 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69884 Buffer over-read in Windows GDI allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108457 Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108460 Use after free in Windows Message Queuing allows an unauthorized attacker to exe... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108461 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108463 Improper resolution of path equivalence in Windows SmartScreen allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108465 Use after free in Windows Update Delivery Optimization allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108468 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108471 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-49785 Improper resource shutdown or release in Windows UEFI allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability |
high | 8.8 | Listed | BerriAI / LiteLLM | 2026-05-08 | 2026-10-26 |
| CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability |
high | 7.2 | Listed | Ivanti / Endpoint Manager Mobile (EPMM) | 2026-05-07 | 2026-10-26 |
| CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer tha... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or mo... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-74757 Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-113076 Use after free in Toolbar in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-115418 SQL injection in the database-query custom resource handlers in the Amazon Web S... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110215 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.