October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14507 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticat... |
high | 7.7 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-88204 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 7.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102863 Improper control of generation of code ('code injection') in Microsoft Office Sh... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102862 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102861 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102860 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105013 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 7.4 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102866 Improper verification of cryptographic signature in Microsoft Office SharePoint... |
high | 8.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70267 Inclusion of functionality from untrusted control sphere in Microsoft Office Sha... |
high | 7.2 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70266 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70251 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70246 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70202 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88166 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88163 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88155 Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85900 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88206 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88200 Privilege context switching error in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88198 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authenticatio... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interfa... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the acc... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of B... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various exter... |
high | 8.0 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-92911 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-78193 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-bas... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104345 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-104995 The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103316 The macOS version of the DigiD app is not signed with Hardened Runtime. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103297 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-103423 The Booking Package plugin for WordPress is vulnerable to authorization bypass i... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-102007 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-101924 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87660 An improper file permission and missing authorization vulnerability exists in th... |
high | 7.1 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87666 An OS command injection vulnerability exists in the time and zone management sub... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87673 An OS command injection vulnerability exists in maintenance command-line diagnos... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87674 A local privilege escalation vulnerability exists in the system logging daemon o... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.