October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88901 Improper Restriction of XML External Entity Reference vulnerability in Apache Ca... |
high | 8.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109841 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109869 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109924 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-109932 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-111214 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111215 Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-111223 Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulner... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-112149 A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112151 A weakness has been identified in vraj404 Criminal Management System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112152 A security vulnerability has been detected in vraj404 Criminal-Management-System... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112153 A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d05... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 8.8 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-108443 Off-by-one error in Microsoft Office Word allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108444 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108445 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108446 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-87018 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-87029 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-108447 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-67404 RabbitMQ is a messaging and streaming broker. |
high | 7.4 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108448 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-67232 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108449 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-66079 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-66070 RabbitMQ is a messaging and streaming broker. |
high | 8.8 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108451 Numeric truncation error in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-15 | 2026-10-19 |
| CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-52023 An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a deni... |
high | 7.5 | — | Kamailio / kamailio | 2026-09-01 | 2026-10-19 |
| CVE-2026-110450 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-107302 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-67405 RabbitMQ is a messaging and streaming broker. |
high | 8.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67233 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-24 | 2026-10-19 |
| CVE-2026-110919 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110920 Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110921 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110922 Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-70012 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.