October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106633 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-119547 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 4.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119546 Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contai... |
medium | 5.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-109976 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-93010 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-85231 A flaw was found in libtirpc. |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-30 |
| CVE-2026-93007 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-93009 A flaw was found in dnsmasq. |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-79705 A flaw was found in the buildah/copier Go package. |
medium | 4.5 | — | — | 2026-09-15 | 2026-10-30 |
| CVE-2026-55653 A flaw was found in OpenSSH. |
medium | 6.5 | — | Openbsd / openssh | 2026-06-23 | 2026-10-30 |
| CVE-2026-55655 A flaw was found in OpenSSH. |
medium | 6.1 | — | Openbsd / openssh | 2026-06-23 | 2026-10-30 |
| CVE-2026-19730 The 'podman quadlet install --replace' command opens the existing destination fi... |
medium | 4.2 | — | — | 2026-08-13 | 2026-10-30 |
| CVE-2026-15588 A denial-of-service and resource exhaustion vulnerability exists within the `GDB... |
medium | 5.3 | — | — | 2026-07-20 | 2026-10-30 |
| CVE-2026-14324 RAOP module accepts unbounded Content-Length values and does not check the pw_ar... |
medium | 6.5 | — | — | 2026-07-01 | 2026-10-30 |
| CVE-2026-115455 A flaw was found in GCC libstdc++. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107176 A flaw was found in the cluster-samples-operator. |
medium | 6.8 | — | — | 2026-10-07 | 2026-10-30 |
| CVE-2026-109969 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-109970 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-109971 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-109968 A flaw was found in the clevis PKCS#11 pin. |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-113495 A flaw was found in cockpit-machines. |
medium | 5.0 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-113496 A flaw was found in cockpit-machines. |
medium | 5.0 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-92824 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-93011 A flaw was found in dnsmasq. |
medium | 5.3 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-76781 A flaw was found in libxml2. |
medium | 5.5 | — | — | 2026-09-17 | 2026-10-30 |
| CVE-2026-92822 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-92823 A flaw was found in libmodulemd. |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-118952 A flaw was found in the Kroxylicious ACL authorizer. |
medium | 6.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-83589 A flaw was found in oauth-proxy. |
medium | 6.1 | — | — | 2026-10-01 | 2026-10-30 |
| CVE-2026-90872 Improper neutralization of directives in dynamically evaluated code in the Manag... |
medium | 6.6 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90720 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.7 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-88090 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
medium | 5.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-90861 Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windo... |
medium | 6.6 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-84296 Multi-Factor Authentication Bypass vulnerability in SSH component in Progress So... |
medium | 6.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-20588 In mtee, there is a possible escalation of privilege due to a missing bounds che... |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-30 |
| CVE-2026-20589 In venc, there is a possible out of bounds write due to type confusion. |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-30 |
| CVE-2026-20579 In vdec, there is a possible out of bounds write due to type confusion. |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-30 |
| CVE-2026-20587 In mtee, there is a possible escalation of privilege due to type confusion. |
medium | 6.7 | — | Mediatek / mt2718 firmware | 2026-10-05 | 2026-10-30 |
| CVE-2026-20470 In Telephony, there is a possible information disclosure due to a missing permis... |
medium | 6.2 | — | — | 2026-08-03 | 2026-10-30 |
| CVE-2026-11822 SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 fu... |
medium | 5.5 | — | Sqlite / sqlite | 2026-06-09 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.