October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,528
Critical
3,295
High
7,946
Medium
7,627
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102052 A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Net... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102055 A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Netwo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102059 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102061 A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of J... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102174 A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101997 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102014 A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Netw... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102015 A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Junip... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102049 A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Netw... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101927 A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos O... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101955 A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101978 An OS Command Injection vulnerability in the bootzd zero-touch provisioning daem... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101981 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96215 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-110108 MateCloud through 5.0.8 contains a missing authorization vulnerability that allo... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110115 Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal v... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110119 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111311 The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, B... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96044 No cwe for this issue in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-16 |
| CVE-2026-70213 Origin validation error in Microsoft Power Apps allows an authorized attacker to... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-62840 Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an auth... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11731 An authentication bypass vulnerability in the listed NETGEAR RAX series models a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11732 An insufficient input validation vulnerability in the website blocking feature (... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111391 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluat... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100207 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-13043 A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMA... |
high | 8.8 | — | Watchguard / endpoint security | 2026-10-01 | 2026-10-16 |
| CVE-2026-12542 A flaw was found in Foreman. |
high | 7.8 | — | Redhat / satellite | 2026-10-01 | 2026-10-16 |
| CVE-2026-108798 A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-85475 A flaw was found in the Ansible Automation Platform automation controller. |
high | 7.2 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-76648 CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =
(IsAuthentic... |
high | 8.5 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-83635 Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70167 Access of resource using incompatible type ('type confusion') in DNS Server allo... |
high | 8.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96945 Uncaught exception in Windows Failover Cluster allows an unauthorized attacker t... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97787 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97792 Improper access control in Windows Container Isolation FS Filter Driver (unionfs... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97794 Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97799 Improper verification of cryptographic signature in Windows Audio Service allows... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97800 Incorrect permission assignment for critical resource in Windows Mobile Broadban... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.