October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75748 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-84884 IBM Guardium Data Protection 12.2 stores internal REST service-account passwords... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-84862 IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in t... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-85542 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-75995 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.4 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-85029 IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensit... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-102201 Use after free in Microsoft Windows Media Foundation allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102202 Improper access control in Windows Container Isolation FS Filter Driver (unionfs... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102203 Access of resource using incompatible type ('type confusion') in RPC Runtime all... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102205 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102207 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102208 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-76001 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-102209 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-20 |
| CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-57... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-79610 XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-68572 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-110005 The `periphery` agent's container-management functionality of Komodo version 2.2... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102702 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102699 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102211 Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102189 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102191 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102192 Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an una... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102193 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102194 Use after free in Windows Graphics Kernel allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-98155 In the Linux kernel, the following vulnerability has been resolved:
accel/qaic:... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-102195 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-71169 Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permis... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-16753 Incorrect authorization in the library-query execution endpoint in Lowcoder vers... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-112772 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112777 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112782 Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exha... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112252 A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-O... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112261 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107082 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticate... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-101292 Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerabilit... |
high | 8.2 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-104937 Shopware version 6.7 allows the upload of attacker‑controlled HTML files and ser... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.