October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83934 Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-75353 OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side E... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-42616 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c... |
high | 7.8 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-19 |
| CVE-2026-50218 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improp... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-112018 cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_ac... |
high | 7.0 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112142 A vulnerability was identified in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111445 Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles token... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110373 Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone nu... |
high | 8.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-106708 XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF)... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-107436 Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials... |
high | 8.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110913 Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remot... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110914 Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110915 Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-112305 Semaphore UI through 2.19.16 contains a remote code execution vulnerability that... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112146 A vulnerability was detected in D-Link E15, M32, R15 and R32. |
high | 7.4 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111990 A weakness has been identified in kishan0725 Hospital Management System up to 77... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112025 A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111398 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.7 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111408 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-100798 Cryptography misuse in Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100803 Same-origin policy bypass in the WebExtensions component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100805 Race condition, use-after-free in the Audio/Video component. |
high | 7.5 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100807 Privilege escalation in the DOM: Service Workers component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100789 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-112306 NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injectio... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112307 sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows a... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112143 A security flaw has been discovered in satya-vinay Events-Management-System up t... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112139 A vulnerability has been found in subhajitkhan online-clinic-management-system u... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112082 A vulnerability was identified in sgl-project SGLang up to 0.5.19. |
high | 7.5 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112044 A security vulnerability has been detected in dotnet eShop up to 913acea66708a59... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111907 phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111866 A weakness has been identified in nemoTyrant manong up to 7c9e5228e133b9267ad3a4... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111871 A weakness has been identified in itsmeravitejak Online-Examination-System up to... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-100790 Use-after-free in the XSLT component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-112001 ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability... |
high | 7.2 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110897 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-108485 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110382 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-100791 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.