October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-53582 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111224 pfSense CE through 2.9.0 contains an OS command injection vulnerability in the O... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111229 pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in ser... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110858 GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerabilit... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110863 Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentica... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110868 Renovate before 44.79.0 contains a server-side request forgery vulnerability tha... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110873 Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability th... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110623 Papermerge Core through 3.5.3 contains a missing authorization vulnerability in... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110628 Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-109221 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107659 The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105443 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insuff... |
high | 8.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-101020 An incorrect permission assignment for critical resource issue exists in AssetVi... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-54710 FreePBX is an open source IP PBX. |
high | 8.8 | — | Sangoma / freepbx | 2026-09-28 | 2026-10-16 |
| CVE-2026-85334 Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthoriz... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85333 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-110859 GitPython before 3.2.0 contains an argument injection vulnerability in Head.chec... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110867 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows r... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110869 Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SM... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111105 Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-69918 Heap-based buffer overflow in Windows Core Messaging allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-75600 FreePBX is an open source IP PBX. |
high | 8.8 | — | Sangoma / freepbx | 2026-09-28 | 2026-10-16 |
| CVE-2026-69916 Integer overflow or wraparound in Windows NTFS allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69915 Use after free in Windows NTFS allows an authorized attacker to elevate privileg... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not ful... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-85795 Use after free in Windows Text Services Framework allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69913 Use after free in Windows TCP/IP allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's J... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-85796 Numeric truncation error in Windows Installer allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85797 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85332 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69909 Heap-based buffer overflow in Microsoft COM for Windows allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85798 Heap-based buffer overflow in Windows Distributed File System (DFS) allows an au... |
high | 7.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85329 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85328 Weak authentication in Windows Projected File System allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85799 Use after free in Network Policy Server (NPS) allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the tot... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-85800 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85914 Use after free in Windows Embedded Mode Service allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85915 Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.