October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N... |
high | 7.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-102196 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-98154 In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma:... |
high | 7.0 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-102197 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88164 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-14 | 2026-10-20 |
| CVE-2026-71170 Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Pa... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111999 Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that a... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in Free... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111723 LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerabil... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-100200 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100201 Heap-based buffer overflow in Windows Client License Service allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100203 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100215 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100216 Stack-based buffer overflow in Windows Storage allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100217 Improper privilege management in Windows Group Policy allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100218 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100220 Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100225 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-62895 Permissive cross-domain policy with untrusted domains in Azure Arc allows an una... |
high | 8.8 | — | Microsoft / azure arc sql server extension | 2026-09-08 | 2026-10-20 |
| CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111219 Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in s... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111373 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the w... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111378 FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption v... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111381 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111382 FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerabil... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-86047 MariaDB server is a community developed fork of MySQL server. |
high | 7.7 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-107807 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-112774 Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112257 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-109126 IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-107809 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107810 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107811 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107400 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112177 A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. |
high | 7.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-107812 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107813 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-63690 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-81452 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Lea... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.