October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79985 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-78165 Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis com... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79983 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79984 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-67225 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67230 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67270 Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Impro... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-108743 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth... |
high | 8.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operat... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-102855 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-20 |
| CVE-2026-108426 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108427 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108428 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108429 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108430 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108431 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108432 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108433 Reliance on untrusted inputs in a security decision in Microsoft Office Word all... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108437 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108439 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108440 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108441 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108442 Use after free in Microsoft Office Word allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-83531 Improper Control of Generation of Code ('Code Injection'), Improper Neutralizati... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-88900 Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups co... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79986 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-88753 A Regular-Expression Denial of Service (ReDoS) in the Markdown2. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-97394 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-58390 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-57489 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110668 A weakness has been identified in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103977 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-104108 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109430 Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) in... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-91157 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.