October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,728
Critical
3,236
High
7,711
Medium
7,361
Low
706
Severity not reported
4,714
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-48398 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-83958 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-119124 ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph... |
medium | 5.5 | — | Imagemagick / imagemagick | 2026-10-29 | 2026-10-31 |
| CVE-2026-85330 Incorrect authorization in Microsoft Edge for Android allows an unauthorized att... |
medium | 4.3 | — | Microsoft / edge | 2026-10-29 | 2026-10-31 |
| CVE-2026-88137 Files or directories accessible to external parties in WebDAV allows an authoriz... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-88158 Out-of-bounds read in Microsoft Digest Authentication allows an authorized attac... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-31 |
| CVE-2026-110081 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-110082 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-31 |
| CVE-2026-7004 WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-1933 A flaw was found in Samba’s handling of NTFS-style reparse points on shares conf... |
medium | 6.5 | — | Redhat / openshift container platform | 2026-05-27 | 2026-10-30 |
| CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107868 Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-77911 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-77491 Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose in... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69609 Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose i... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69304 Improper handling of highly compressed data (data amplification) in ASP.NET Core... |
medium | 5.9 | — | Microsoft / asp.net core | 2026-09-08 | 2026-10-30 |
| CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-58649 Origin validation error in .NET allows an unauthorized attacker to disclose info... |
medium | 6.5 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-59993 Picotls is a TLS protocol library that allows users select different crypto back... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-57185 Asterisk is an open source private branch exchange and telephony toolkit. |
medium | 6.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operat... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-114620 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
medium | 5.4 | — | Authlib / authlib | 2026-10-22 | 2026-10-30 |
| CVE-2026-107310 Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Se... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Exa... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107262 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem al... |
medium | 5.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107307 Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful B... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-86987 An authorization issue was addressed with improved entitlement checks. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-10-30 |
| CVE-2026-76287 In Splunk Enterprise versions below 10.4.4, a user that holds a role with the pr... |
medium | 5.4 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76289 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user... |
medium | 6.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-96391 Missing Authorization vulnerability in Drupal Webform REST allows Forceful Brows... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-96389 Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsin... |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-88084 Allocation of resources without limits or throttling in SQL Server allows an aut... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88086 Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose inf... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-86959 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-87938 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-86935 This issue was addressed by removing additional entitlements. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-30 |
| CVE-2026-86944 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-84582 A privacy issue was addressed with improved access restrictions. |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-7005 WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin requ... |
medium | 6.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-68482 Missing Authorization vulnerability in Apache Answer. |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.