October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113873 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113874 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identi... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111613 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability |
high | 7.5 | Listed | JFrog / Artifactory | 2026-08-12 | 2026-10-23 |
| CVE-2026-98093 In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl_m... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-113145 Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113156 Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113163 Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113164 Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113088 Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.4... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-83862 Use after free in Windows Network Load Balancing allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-113091 Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113092 Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.4... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113096 Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113099 Improper input validation in Omnibox in Google Chrome on on Android prior to 156... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113107 Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 al... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113117 Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.807... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113119 Use after free in Network in Google Chrome on on Windows prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113121 Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-113134 Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-68836 Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69326 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69354 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69363 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69387 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69452 Use after free in Windows Enterprise App Management allows an authorized attacke... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69471 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69521 Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-91635 Vulnerability in Oracle Essbase (component: Security). |
high | 8.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-91647 Vulnerability in Oracle Essbase (component: Security). |
high | 8.1 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-87901 Improper sanitization in the registration module allows reflected Cross-Site Scr... |
high | 8.3 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-111638 sshportal through 1.19.5 contains a missing authorization vulnerability in the m... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-97635 The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided inpu... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115414 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might a... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-91664 Vulnerability in Oracle Essbase (component: Security). |
high | 7.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-23 |
| CVE-2026-115371 Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115374 Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a signature verificatio... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112331 Motor.NET before 0.19.0 contains a denial-of-service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112778 Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation f... |
high | 8.8 | — | Traefik / traefik | 2026-10-19 | 2026-10-23 |
| CVE-2026-112390 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.