October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91159 Discourse is an open-source discussion platform. |
high | 7.7 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-92150 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-54554 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-73260 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110646 Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vuln... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110616 NullHub through 2026.5.29 contains a missing authentication vulnerability that a... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110621 Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in Pro... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 contains an OS command injection vul... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103043 anchorme through 3.0.8 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-20 |
| CVE-2026-102695 OmniFaces is a utility library for Faces. |
high | 8.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109527 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2016-15060 A vulnerability was found in PCMan FTP Server up to 2.0.7. |
high | 8.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-100236 A flaw was found in the DPDK GSO library. |
high | 8.6 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-84506 A use after free issue was addressed with improved memory management. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-10-20 |
| CVE-2026-88160 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88161 Use after free in Windows Local Security Authority (LSA) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88165 Out-of-bounds write in Active Directory Domain Services allows an authorized att... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88168 Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88171 Double free in Windows DHCP Server allows an unauthorized attacker to execute co... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88173 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88174 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88177 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88179 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88180 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88181 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88193 Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88219 Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96246 Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96856 Heap-based buffer overflow in Windows Management Instrumentation allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. |
high | 8.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-87766 A flaw was found in bubblewrap. |
high | 8.8 | — | — | 2026-09-09 | 2026-10-20 |
| CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of... |
high | 7.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-83966 Substance3D - Sampler is affected by an out-of-bounds write vulnerability that c... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-10-13 | 2026-10-20 |
| CVE-2026-83965 Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-10-13 | 2026-10-20 |
| CVE-2026-105898 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.2 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-103843 Substance3D - Stager is affected by a Use After Free vulnerability that could re... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103842 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103841 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103840 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.