October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89906 In the Linux kernel, the following vulnerability has been resolved:
LoongArch:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89913 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89806 In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb:... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89755 In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89705 In the Linux kernel, the following vulnerability has been resolved:
nfsd: resto... |
high | 7.1 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89632 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 8.2 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89624 In the Linux kernel, the following vulnerability has been resolved:
HID: univer... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-80935 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
high | 8.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-80734 In the Linux kernel, the following vulnerability has been resolved:
btrfs: init... |
high | 8.8 | — | — | 2026-09-03 | 2026-10-21 |
| CVE-2026-83886 Use after free in Windows Update Orchestrator Service allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability |
high | 7.2 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-83896 Heap-based buffer overflow in Windows Direct Composition allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83899 Improper privilege management in Windows Installer allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83900 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-80110 A flaw was found in pki-core. |
high | 8.1 | — | — | 2026-09-21 | 2026-10-21 |
| CVE-2026-76561 A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority compo... |
high | 7.2 | — | — | 2026-09-08 | 2026-10-21 |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability |
high | 7.5 | Listed | SolarWinds / Serv-U | 2026-06-04 | 2026-10-21 |
| CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with cr... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-21 |
| CVE-2026-84268 A flaw was found in the SFTP backend in gvfs. |
high | 8.8 | — | — | 2026-09-01 | 2026-10-21 |
| CVE-2026-86919 A stack overflow was addressed with improved input validation. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-86922 A type confusion issue was addressed with improved state management. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-86961 A race condition was addressed with additional validation. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-76740 A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms,... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-21 |
| CVE-2026-28853 The issue was addressed with improved checks. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-28328 SolarWinds Observability Self-Hosted was found to be affected by a broken author... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-107366 IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perf... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-105453 IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-92263 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-48741 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111380 FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audi... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111447 Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary k... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-95183 An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111359 CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerabi... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111160 LightLLM through 1.2.0 contains a denial of service vulnerability that allows un... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111125 CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in... |
high | 7.1 | — | Nasa / cfitsio | 2026-10-15 | 2026-10-21 |
| CVE-2026-55239 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55872 GYM One is open-source gym management software for fitness centers, personal tra... |
high | 8.7 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111217 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-111222 Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-21 |
| CVE-2026-104828 HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. |
high | 7.2 | — | — | 2026-10-15 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.