October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-116253 A vulnerability was determined in DedeCMS 5.7.118. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116183 phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerabili... |
high | 7.5 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116163 Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authenti... |
high | 7.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116117 A flaw has been found in halo-dev halo up to 2.27.0-beta.1. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116068 Dokploy through 0.30.10 contains an authorization bypass vulnerability that allo... |
high | 8.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116060 A vulnerability was determined in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-109346 better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109164 TDuck survey form through 6.0 contains an insecure direct object reference vulne... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109331 Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerab... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-109341 SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allow... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-105773 Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalat... |
high | 7.0 | — | — | 2026-10-05 | 2026-10-26 |
| CVE-2026-115717 Frappe Builder versions before 1.36.1 contain a server-side request forgery vuln... |
high | 7.7 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116016 yudao-cloud through 2026.09 contains an authorization bypass vulnerability that... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-115721 **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysp... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115748 **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all version... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-90885 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-61931 Use after free in Windows Perception Simulation Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69596 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69633 Heap-based buffer overflow in Windows Update allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103553 Out-of-bounds read in Windows Partition Management Driver allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103554 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103558 Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-103565 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-98166 In the Linux kernel, the following vulnerability has been resolved:
drm/ttm: fi... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-26 |
| CVE-2026-77931 MoviePilot through 3.1.5 contains a command injection vulnerability that allows... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-76300 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76526 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-116543 Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115189 A server-side template injection vulnerability exists in the Twig theme renderin... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115190 An insecure deserialization (PHP object injection) vulnerability exists in Mauti... |
high | 8.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115191 A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Ma... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115192 An SQL Injection vulnerability exists in the dashboard widget data API endpoint... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115193 A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail v... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111216 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111221 Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerabilit... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111226 pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability th... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-111231 Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-26 |
| CVE-2026-111124 CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in... |
high | 7.1 | — | Nasa / cfitsio | 2026-10-15 | 2026-10-26 |
| CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-96867 Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.