October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114613 MessagePack is the serializer implementation for Python msgpack.org. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115348 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110975 A flaw was found in Kruize Autotune. |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-112342 Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/h... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of servi... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-91406 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91407 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91405 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111312 OpenHealth through 0.2.0 contains a missing authentication and authorization vul... |
high | 7.7 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111352 ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in Rest... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111280 snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7Micro... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-113217 Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113210 Use after free in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113207 Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.80... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-13599 Missing authentication for critical function vulnerability in ABB Ability Edgeni... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-92450 The authentication framework used by affected Kiloview E3 NDI encoder firmware s... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-63120 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup dat... |
high | 8.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106765 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute ar... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-69673 Improper link resolution before file access ('link following') in Windows Update... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69718 Improper neutralization of special elements used in a command ('command injectio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69733 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108132 Double free in Windows Kerberos allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108135 Improper link resolution before file access ('link following') in Windows Backup... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-114648 The MongoDB C# Driver does not neutralize dot and dollar characters in dictionar... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111594 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115863 ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message... |
high | 7.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-105482 A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be si... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-105483 A flaw in Node.js TLS hostname verification allows a certificate without a match... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-106069 A flaw in Node.js TLS hostname verification can cause a server certificate to be... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-108136 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108396 Time-of-check time-of-use (toctou) race condition in Windows Modern Device Manag... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-23 |
| CVE-2026-111633 ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.