October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95709 Command injection vulnerabilities exist in the affected interface of AOS-10 that... |
high | 7.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operat... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95711 An authentication bypass vulnerability in the web-based management interface of... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95712 A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 c... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95713 An unauthenticated buffer overflow vulnerability exists in the command line inte... |
high | 7.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-79678 A flaw was found in FreeIPA's idp-add command, where insufficiently validated --... |
high | 8.1 | — | — | 2026-09-07 | 2026-10-26 |
| CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch betwe... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability th... |
high | 7.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115948 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115608 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108456 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized atta... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115778 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115251 The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upg... |
high | 7.2 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-19741 Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with defau... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79977 The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endp... |
high | 8.2 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79979 The arm64 MMU backend invalidates a single virtual address from the TLB with inv... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-79982 The Bluetooth HCI USB transport class of the new USB device stack, subsys/usb/de... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-83924 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate th... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113673 The GeoDirectory WordPress plugin before 2.8.194 does not properly escape admini... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-70388 SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device... |
high | 8.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82944 SOEM version 2.0.0 and earlier contains a vulnerability in multi-segment data tr... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-82947 SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame proces... |
high | 7.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-112844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112869 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114178 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114694 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114191 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114704 Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116110 A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116116 A vulnerability was detected in Yoosee GM8135S Camera 21.00.01.36. |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-111841 Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116237 A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. |
high | 8.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-83927 Improper link resolution before file access ('link following') in Windows Regist... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83928 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83929 Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute co... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83930 Use after free in Windows Update Orchestrator Service allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.