October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,513
Critical
3,295
High
7,934
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109778 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109756 Privilege escalation in the DOM: Navigation component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103418 Firefox for iOS directly interpolated the page’s HTML language attribute into tr... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102226 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102869 Access of resource using incompatible type ('type confusion') in .NET and Visual... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100214 Deserialization of untrusted data in Dynamics Business Central allows an authori... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-84837 A flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-84838 A flaw was found in rpmuncompress. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-108623 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108628 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108522 A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. |
high | 8.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently prot... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108108 PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-75349 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bound... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107782 System Informer before 4.0.26241.138 contains an incorrect authorization vulnera... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107723 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 8.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107728 Strawberry GraphQL is a library for creating GraphQL APIs. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107377 datamodel-code-generator generates Python data models from schema definitions. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-97801 Improper validation of specified type of input in .NET Framework allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70186 Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70181 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69454 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69370 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108398 Untrusted search path in .NET Framework allows an authorized attacker to bypass... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108400 Integer overflow or wraparound in Microsoft Windows Codecs Library allows an una... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105728 Improper authentication in Dynamics Business Central allows an unauthorized atta... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70049 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105729 Untrusted pointer dereference in SysInternals allows an authorized attacker to e... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105732 Stack-based buffer overflow in SysInternals allows an authorized attacker to ele... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105725 Use after free in Windows Security App allows an authorized attacker to elevate... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105727 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103572 Improper control of generation of code ('code injection') in Visual Studio Tools... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-102232 Incorrect authorization in Visual Studio Code allows an unauthorized attacker to... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100205 Untrusted pointer dereference in SysInternals allows an authorized attacker to e... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.