October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-58363 SurrealDB before 1.5.4 fails to properly validate authentication when a scope us... |
medium | 6.3 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2023-53907 Bludit versions before 3.13.0 contain an authenticated file download vulnerabili... |
medium | 6.5 | — | Bludit / bludit | 2025-12-17 | 2026-10-29 |
| CVE-2026-69967 Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to di... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83667 Out-of-bounds read in Active Directory Domain Services allows an authorized atta... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-110073 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110074 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110075 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-72770 n8n versions before 1.123.67 contain a path traversal vulnerability in the Git n... |
medium | 6.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65599 n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure v... |
medium | 6.5 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-72749 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerabi... |
medium | 6.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72763 n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a n... |
medium | 6.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65593 n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a server-side request f... |
medium | 5.4 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-65594 n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth... |
medium | 6.5 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-65597 n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based c... |
medium | 5.4 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-25448 Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incor... |
medium | 4.3 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118097 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
medium | 6.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116169 SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116181 vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerabili... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116193 Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116136 ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerabili... |
medium | 5.9 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116141 ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR d... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116044 A security vulnerability has been detected in prasathmani TinyFileManager up to... |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116047 A vulnerability has been found in Privoce Vocechat up to 0.9.121. |
medium | 4.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116066 Firecrawl before 2.11.586 contains a server-side request forgery vulnerability i... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116070 Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in th... |
medium | 6.5 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-110076 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-110077 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-83760 Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker t... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-96206 Use of uninitialized resource in Windows Subsystem for Linux allows an authorize... |
medium | 5.5 | — | Microsoft / windows subsystem for linux | 2026-10-13 | 2026-10-29 |
| CVE-2026-83737 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83736 Heap-based buffer overflow in Windows Kernel allows an authorized attacker to el... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83571 Null pointer dereference in Windows Audio Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-76406 In Splunk SOAR versions below 8.7.0, an unauthenticated user with access to encr... |
medium | 5.9 | — | Splunk / soar | 2026-10-21 | 2026-10-29 |
| CVE-2026-83683 Absolute path traversal in Windows Encrypting File System (EFS) allows an author... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83685 Buffer over-read in Windows IKE Extension allows an authorized attacker to deny... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83703 Out-of-bounds read in Windows Wi-Fi Driver allows an unauthorized attacker to de... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83705 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83713 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83714 Use of uninitialized resource in Windows HTTP.sys allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83723 Use of uninitialized resource in Windows Event Logging Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.