October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83733 Out-of-bounds read in Windows Print Spooler Components allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85830 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85831 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85840 Files or directories accessible to external parties in Windows Event Viewer allo... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85841 Use after free in Windows DHCP Server allows an authorized attacker to execute c... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85847 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85852 Out-of-bounds read in Windows Management Instrumentation allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85857 Insertion of sensitive information into log file in Windows Kernel-Mode Drivers... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85859 Null pointer dereference in Windows Message Queuing Queue Manager allows an auth... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85865 Improper authentication in Windows DHCP Server allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-110079 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-96405 NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-65592 n8n before 1.123.64, 2.29.8, and 2.30.1 contains a stored DOM cross-site scripti... |
medium | 5.4 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-59259 n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vu... |
medium | 6.5 | — | N8n / n8n | 2026-07-15 | 2026-10-29 |
| CVE-2026-65589 n8n versions before 1.123.64 fail to properly mask custom HTTP header credential... |
medium | 6.5 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-58661 n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space... |
medium | 4.3 | — | N8n / n8n | 2026-07-10 | 2026-10-29 |
| CVE-2026-56777 n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree (AST... |
medium | 5.0 | — | N8n / n8n | 2026-06-30 | 2026-10-29 |
| CVE-2026-56775 n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability... |
medium | 5.4 | — | N8n / n8n | 2026-07-08 | 2026-10-29 |
| CVE-2026-56778 n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in t... |
medium | 6.4 | — | N8n / n8n | 2026-07-08 | 2026-10-29 |
| CVE-2026-50106 When NLnet Labs Unbound up to and including version 1.26.1 is configured with bo... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-54162 Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP suppor... |
medium | 4.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-56358 n8n before 1.123.25 (1.x) and before 2.11.2 (2.x), with the fix also included in... |
medium | 5.4 | — | N8n / n8n | 2026-06-24 | 2026-10-29 |
| CVE-2026-56356 n8n contains a stored cross-site scripting vulnerability in the Chat Trigger nod... |
medium | 5.4 | — | N8n / n8n | 2026-06-30 | 2026-10-29 |
| CVE-2026-56359 n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential... |
medium | 5.4 | — | N8n / n8n | 2026-07-08 | 2026-10-29 |
| CVE-2026-56354 n8n before 1.123.24, 2.10.4, and 2.12.0 (across its 1.x and 2.x branches) contai... |
medium | 5.4 | — | N8n / n8n | 2026-07-10 | 2026-10-29 |
| CVE-2026-118667 LangGraph Python SDK is used to connect to running LangGraph API servers, manage... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116017 Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference v... |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-118655 Echo is a Go web framework. |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118663 @hono/node-server allows running the Hono application on Node.js. |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115972 A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. |
medium | 5.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115982 A vulnerability was detected in phpIPAM up to 1.8.3. |
medium | 4.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115997 A flaw has been found in pig-mesh pig up to 4.1.0. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-111088 A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-115796 A security flaw has been discovered in Tenda F6 12.02.01.73. |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115801 A security flaw has been discovered in Kakao khaiii up to 0.4. |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-115886 MLflow is an open source AI engineering platform for agents, large language mode... |
medium | 6.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-109576 The parser in PEAK-System PCAN driver correctly detected the malformed record, b... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-109125 In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-le... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-101103 The PEAK-System PCAN diagnostic call did not validate that the caller-supplied o... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83960 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) v... |
medium | 5.4 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.