October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97809 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97811 Double free in OpenSSH for Windows allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97812 Double free in Windows Update Orchestrator Service allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97798 Improper neutralization of argument delimiters in a command ('argument injection... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97804 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97806 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97807 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97808 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97793 Missing authentication for critical function in Windows Setup and Deployment all... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96953 Null pointer dereference in Windows Universal Disk Format File System Driver (UD... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97339 The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96947 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96949 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96950 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96952 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96937 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96946 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96243 Improper link resolution before file access ('link following') in Windows Wallet... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96071 Heap-based buffer overflow in Windows Media allows an unauthorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96118 Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96209 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-86008 Mailu is a mail server distributed as a set of Docker images. |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111446 Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108131 No cwe for this issue in Active Directory Federation Services (AD FS) allows an... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105410 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105411 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105412 An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could al... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102176 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102037 An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102050 A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Netwo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102056 An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Juno... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102029 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102030 An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102022 A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juni... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102023 A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evo... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102024 An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of J... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102025 A Mismatched Memory Management Routines vulnerability in the routing protocol da... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102026 An Improper Control of a Resource Through its Lifetime vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102027 An Incorrect Calculation of Buffer Size vulnerability in the routing protocol da... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102028 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.