October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69882 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69991 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-90948 A flaw was found in GIMP's ICO file loader. |
high | 7.8 | — | — | 2026-09-14 | 2026-10-19 |
| CVE-2026-90947 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-09-14 | 2026-10-19 |
| CVE-2026-92248 A flaw was found in the file-psd plugin in GIMP. |
high | 7.8 | — | — | 2026-09-15 | 2026-10-19 |
| CVE-2026-97185 A flaw was found in GIMP. |
high | 7.8 | — | — | 2026-09-24 | 2026-10-19 |
| CVE-2026-41582 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-77474 destructive_command_guard (dcg) is a command-line safety tool that blocks destru... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111605 Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileCo... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-109746 Mitigation bypass in the DOM: Security component. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109747 Other issue in the Address Bar component. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109754 Incorrect boundary conditions in the DOM: Editor component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109759 Site isolation issue in the Networking component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109760 Mitigation bypass in the Networking: HTTP component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109766 Mitigation bypass in the Enterprise Policies component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Route... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-69992 Use after free in Windows Remote Desktop Services allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability |
high | 8.8 | Listed | Ray-Project / Ray | 2025-11-26 | 2026-10-19 |
| CVE-2026-69994 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69995 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69996 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69997 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69998 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70004 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70013 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progre... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfe... |
high | 7.5 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certif... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-109744 Other issue in the DOM: File component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109737 Mitigation bypass in the Enterprise Policies component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109734 Mitigation bypass in the DOM: Security component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109736 Frame poisoning in the Layout component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109720 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Trans... |
high | 7.3 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89077 Incorrect implementation of authentication algorithm vulnerability in Progress M... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-93569 A flaw was found in Netty. |
high | 8.2 | — | — | 2026-09-18 | 2026-10-19 |
| CVE-2026-93567 A flaw was found in Netty's HTTP/2 codec. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.