October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65198 Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both au... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95114 libwebsockets contains an out-of-bounds read vulnerability in the LEJP increment... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95115 Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote att... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95121 An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95122 mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::Genera... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95124 Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110359 Hyland Desktop Host for Windows before 25.1.1 is vulnerable to local privilege e... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110449 Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant o... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105429 Improper neutralization of special elements in the NetBird client SSH configurat... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the
af... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95179 An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attack... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45450 : Improper Restriction of Operations within the Bounds of a Memory Buffer vulner... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45451 : Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/U... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-45452 Use of Externally-Controlled format string vulnerability in Unitronics Unitronic... |
high | 8.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95155 FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-36436 An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in pla... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106700 ELADMIN v2.7 and earlier contains an improper access control vulnerability in th... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106705 ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-77206 Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP ha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77207 Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-94453 Libreswan's pluto daemon has a use-after-free vulnerability when a client connec... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110908 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2023-32198 A vulnerability has been identified in Steve where by default it was using an in... |
high | 8.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-75941 A potential vulnerability was reported in the Lenovo Legion Zone application, di... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92629 A potential improper authorization vulnerability was reported in Lenovo Baiying... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-46472 An issue was discovered in GStreamer gst-plugins-good before 1.28.2. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85822 Heap-based buffer overflow in Windows exFAT File System allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85823 Use after free in Windows Composite Image File System allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85824 Use after free in Windows Composite Image File System allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85825 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85826 Out-of-bounds write in Windows Fast FAT Driver allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85807 Integer overflow or wraparound in Windows USB Video Driver allows an authorized... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85808 Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96920 Heap-based buffer overflow in Windows Program Compatibility Assistant Service al... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85810 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96923 Use after free in Windows Workstation Service allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85811 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96928 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96929 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96939 Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates all... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.