October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-82026 Radar before 1.12.2 contains a missing authorization vulnerability in the handle... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2017-20286 DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110633 MyReport Updater through 2.1.1 contains a local privilege escalation vulnerabili... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-70023 Use after free in Windows Hyper-V allows an authorized attacker to elevate privi... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85215 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 7.1 | — | — | 2026-10-02 | 2026-10-16 |
| CVE-2026-85457 IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-93649 In the Eclipse Adoptium website (adoptium.net), in every deployment built from c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-13138 Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Softwa... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111702 ChatOllama through commit 96c3ce5 contains an insecure direct object reference v... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111722 LingGuo-Drama through commit 8a6924a contains an insecure direct object referenc... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111282 Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-109715 Incorrect boundary conditions in the JavaScript Engine component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109716 Incorrect boundary conditions in the JavaScript Engine component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109722 JIT miscompilation in the JavaScript Engine: JIT component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110724 In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `Cl... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106062 A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-16 |
| CVE-2026-109712 Sandbox escape due to uninitialized memory in the Graphics component. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-70045 Use after free in Windows Work Folders allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109308 Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates'... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109563 N3.js before 2.11.1 contains a regular expression denial of service vulnerabilit... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-70038 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70031 Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to d... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70027 Heap-based buffer overflow in Windows Subsystem for Linux allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70026 Use after free in Windows Secure Kernel Mode allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70015 Use after free in Windows Local Security Authority Subsystem Service (LSASS) all... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70014 Use after free in Windows Cryptographic Services allows an authorized attacker t... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69959 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to ex... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85371 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69957 Integer overflow or wraparound in Windows Overlay Filter allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85365 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69952 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69953 Buffer over-read in Windows Overlay Filter allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96919 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96918 Improper access control in Windows NTFS allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96917 Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attack... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69950 Buffer over-read in Windows Overlay Filter allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69949 Heap-based buffer overflow in Windows Client for NFS allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110618 SmsForwarder through 3.5.0 contains a missing authentication vulnerability in it... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110648 @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerab... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.