October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,594
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113118 Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113141 Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113019 Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113009 Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113018 Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-96959 Allocation of resources without limits or throttling in .NET allows an unauthori... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96960 Asymmetric resource consumption (amplification) in .NET allows an unauthorized a... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96957 Improper verification of cryptographic signature in .NET allows an unauthorized... |
high | 8.8 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96958 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96232 Out-of-bounds read in .NET allows an unauthorized attacker to disclose informati... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96233 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96235 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96237 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96222 Improper certificate validation in Active Directory Federation Services (AD FS)... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96224 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96225 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96230 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96231 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-87697 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-85363 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-84008 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-83520 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70190 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70179 Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70174 Improperly implemented security check for standard in .NET allows an unauthorize... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70159 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70161 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70035 Deserialization of untrusted data in .NET Framework allows an unauthorized attac... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70007 Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-69651 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-113386 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP comm... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113394 A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112940 filelock is a platform-independent file lock for Python. |
high | 7.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-22 |
| CVE-2026-111765 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-109468 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-109440 LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-6554 libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a sig... |
high | 7.5 | — | — | 2026-09-05 | 2026-10-22 |
| CVE-2026-112775 Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerabili... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112780 Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that al... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.