October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83789 Heap-based buffer overflow in Windows SMB Client allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-91341 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
critical | 9.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-57169 Dockhand is a Docker management application. |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-114575 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114268 A flaw has been found in Tenda BE3L Pro 16.03.60.62. |
critical | 9.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114383 A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. |
critical | 10.0 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2023-0758 A vulnerability was found in glorylion JFinalOA 1.0.2 and classified as critical... |
critical | 9.8 | — | Jfinaloa Project / jfinaloa | 2023-02-09 | 2026-10-28 |
| CVE-2023-0745 The High Availability functionality of Yugabyte Anywhere can be abused to write... |
critical | 9.8 | — | Yugabyte / yugabytedb managed | 2023-02-09 | 2026-10-28 |
| CVE-2023-1357 A vulnerability, which was classified as critical, has been found in SourceCodes... |
critical | 9.8 | — | Simple Bakery Shop Management System Project / simple bakery shop management system | 2023-03-12 | 2026-10-28 |
| CVE-2023-54203 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: fix... |
critical | 9.1 | — | — | 2025-12-30 | 2026-10-28 |
| CVE-2023-54223 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2025-12-30 | 2026-10-28 |
| CVE-2023-54342 Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution v... |
critical | 9.8 | — | — | 2026-05-05 | 2026-10-28 |
| CVE-2023-54344 Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerab... |
critical | 9.8 | — | — | 2026-05-05 | 2026-10-28 |
| CVE-2023-46453 Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting... |
critical | 9.8 | — | — | 2026-05-08 | 2026-10-28 |
| CVE-2023-24215 Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware... |
critical | 9.1 | — | — | 2026-05-18 | 2026-10-28 |
| CVE-2026-63939 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: C... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-63940 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: I... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-91354 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-39795 Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-28 |
| CVE-2026-118340 Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remo... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118342 Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118355 Improper input validation in Command in Google Chrome prior to 156.0.8078.73 all... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118310 Improper input validation in Views in Google Chrome on on Windows prior to 156.0... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118312 Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a rem... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118316 Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118321 Improper input validation in Core in Google Chrome on on Android prior to 156.0.... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118332 Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118306 Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118308 Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote a... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118309 Improper input validation in UI in Google Chrome on on Android prior to 156.0.80... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118305 Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a... |
critical | 9.6 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103688 The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not... |
critical | 9.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116099 A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay... |
critical | 9.8 | — | Fcs-ex / scp\ | 2026-10-26 | 2026-10-28 |
| CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google... |
critical | 9.8 | Listed | Google / brotli | 2026-10-22 | 2026-10-28 |
| CVE-2026-116230 A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24... |
critical | 9.8 | — | Ndemiccreations / plague inc | 2026-10-26 | 2026-10-28 |
| CVE-2026-70153 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70147 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70262 Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-74990 Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox... |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74989 Internally found bugs present in Firefox 153. |
critical | 9.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.