October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,538
Critical
3,296
High
7,954
Medium
7,627
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-111451 Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-suppli... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111114 The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110444 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110445 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-109400 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vul... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107746 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103895 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104000 The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103636 Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C+... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-102233 Missing authorization in Visual Studio Code allows an unauthorized attacker to b... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-101994 An Improper Handling of Length Parameter Inconsistency vulnerability in the
l2... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102012 A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102016 An Improper Validation of Specified Quantity in Input vulnerability in the rpd p... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102064 A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juni... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101939 A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101944 An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101945 An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2013-10076 ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-67407 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-96248 Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96249 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-41510 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-95837 containerd is an open-source container runtime. |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-61642 Squid is a caching proxy for the Web. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108375 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108377 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108378 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108382 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108383 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53612 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53613 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53614 util-linux is a random collection of Linux utilities. |
high | 7.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-53615 util-linux is a random collection of Linux utilities. |
high | 8.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-108395 The Model Context Protocol Java SDK is the official Java SDK for Model Context P... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-54525 Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110746 A local privilege escalation vulnerability in TotalAV allows an unprivileged loc... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-88071 Double free in Windows Hyper-V allows an authorized attacker to elevate privileg... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88074 Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) En... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88075 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / configuration manager 2503 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88079 Null pointer dereference in Windows MIDI Service Module allows an authorized att... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.