October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110220 Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vu... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerabili... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110111 Xen Orchestra before 6.9.0 contains an improper access control vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-116199 Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController:... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-26 |
| CVE-2026-112345 TTLock Android application before v9.8.260718 and associated smart-lock firmware... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116339 A vulnerability was determined in iFlytek astron-agent up to 1.1.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115935 The app/process-api-response-headers action accepts fake Craft API response head... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115937 The Mollie webhook endpoint accepts two independent, attacker-controlled paramet... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-116011 Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116489 Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability tha... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-113079 Use after free in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-113080 Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-113083 Memory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-26 |
| CVE-2026-98143 In the Linux kernel, the following vulnerability has been resolved:
accel: etho... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-26 |
| CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entr... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of me... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is sma... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115938 Craft CMS allows any authenticated control panel user to submit an element-searc... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-81038 The Object Transfer Service server builds its Object Action Control Point (OACP)... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105765 HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-93441 IBM QRadar SIEM could allow a remote attacker to cause a denial of service due t... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-50787 e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116049 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116000 A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-110690 Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path trav... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110018 The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-102941 The package github.com/gomarkdown/markdown is a Go library for parsing Markdown... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-26 |
| CVE-2021-48012 fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability |
high | 7.3 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
| CVE-2026-69970 Heap-based buffer overflow in Microsoft Streaming Service allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69976 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69977 Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69984 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69985 Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-105722 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-95127 An issue in libass v.0.17.5 allows a remote attacker to cause a denial of servic... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-116256 A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030... |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.