October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,702
Critical
3,236
High
7,701
Medium
7,358
Low
705
Severity not reported
4,702
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-102479 In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], th... |
medium | 5.9 | — | Eclipse / vert.x | 2026-10-14 | 2026-10-28 |
| CVE-2026-93636 An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allow... |
medium | 4.3 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-93638 A reflected cross-site scripting vulnerability in the login page of Zimbra Colla... |
medium | 6.1 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-85935 Buffer over-read in Windows USB Driver allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85938 Improper access control in Windows Broadcast DVR User Service allows an authoriz... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85939 Weak authentication in Windows Kernel allows an authorized attacker to bypass a... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-101423 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.3 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-101430 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 6.2 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-101433 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 5.3 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-101486 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 5.4 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-101487 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 5.4 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
| CVE-2026-101731 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.9 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-28 |
| CVE-2026-101732 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
medium | 4.9 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-28 |
| CVE-2026-93627 An organizer authentication vulnerability in the email calendar processing of Zi... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93628 An attendee authentication vulnerability in the email calendar processing of Zim... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93629 An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) al... |
medium | 5.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-93630 A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra... |
medium | 4.3 | — | — | 2026-10-23 | 2026-10-28 |
| CVE-2026-91292 Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-62899 Inconsistent interpretation of http requests ('http request/response smuggling')... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62900 Improper removal of sensitive information before storage or transfer in .NET all... |
medium | 5.9 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62902 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
medium | 6.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62740 Use of uninitialized resource in Windows Imaging Component allows an authorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62322 Python Social Auth is a social authentication/registration mechanism. |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-57183 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-57083 Use of uninitialized resource in Microsoft Windows Codecs Library allows an unau... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-57084 Use of uninitialized resource in Windows File Explorer allows an unauthorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-28 |
| CVE-2026-54683 NL Portal Backend Libraries provide backend components for Dutch government port... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-28 |
| CVE-2026-50659 Improper encoding or escaping of output in .NET allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / .net framework | 2026-07-14 | 2026-10-28 |
| CVE-2026-50526 Improper link resolution before file access ('link following') in .NET allows an... |
medium | 5.5 | — | Microsoft / .net | 2026-07-14 | 2026-10-28 |
| CVE-2026-40375 Missing authorization in Dynamics Business Central allows an authorized attacker... |
medium | 6.5 | — | Microsoft / dynamics 365 business central 2024 | 2026-08-11 | 2026-10-28 |
| CVE-2026-109681 The FTP client trusts the server's PASV response IP:port without validation agai... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-109682 Metasploit Framework versions before 6.5.7 allow HTTP requests made through send... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-7043 The ForgeRock client fails to correctly validate refresh tokens. |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2023-53658 In the Linux kernel, the following vulnerability has been resolved:
spi: bcm-qs... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53661 In the Linux kernel, the following vulnerability has been resolved:
bnxt: avoid... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53662 In the Linux kernel, the following vulnerability has been resolved:
ext4: fix m... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53664 In the Linux kernel, the following vulnerability has been resolved:
OPP: Fix po... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53674 In the Linux kernel, the following vulnerability has been resolved:
clk: Fix me... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53677 In the Linux kernel, the following vulnerability has been resolved:
drm/i915: F... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53678 In the Linux kernel, the following vulnerability has been resolved:
drm/i915: F... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.