October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,702
Critical
3,236
High
7,701
Medium
7,358
Low
705
Severity not reported
4,702
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-53679 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt760... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53681 In the Linux kernel, the following vulnerability has been resolved:
bcache: Fix... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53682 In the Linux kernel, the following vulnerability has been resolved:
hwmon: (xge... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53683 In the Linux kernel, the following vulnerability has been resolved:
fs: hfsplus... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2023-53684 In the Linux kernel, the following vulnerability has been resolved:
xfrm: Zero... |
medium | 5.5 | — | Linux / linux kernel | 2025-10-07 | 2026-10-28 |
| CVE-2026-87709 Improper access control in Windows Host Guardian Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-88140 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83636 Null pointer dereference in Windows Hyper-V allows an authorized attacker to den... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83582 Use after free in Windows Graphics Kernel allows an authorized attacker to discl... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96858 Missing authentication for critical function in Windows Security Account Manager... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96859 Out-of-bounds read in Windows Imaging Component allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96860 Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83573 Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthori... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83565 Buffer over-read in Windows Encrypting File System (EFS) allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96638 Pillow is a Python imaging library. |
medium | 6.5 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-91320 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
medium | 5.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91324 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Librar... |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91339 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Ser... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91317 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91318 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91319 Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (comp... |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-85518 A flaw was found in OpenSCAP. |
medium | 6.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-62362 PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent p... |
medium | 4.9 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-57446 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-59962 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-118684 MONAI before 1.6.1 contains an insufficient integrity verification vulnerability... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118677 n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulne... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118646 n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118640 n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnera... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116171 SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass i... |
medium | 4.4 | — | — | 2026-10-25 | 2026-10-28 |
| CVE-2026-114633 WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114374 A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114380 A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-102923 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
medium | 5.4 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2020-37284 Sickbeard through build-507 contains a reflected cross-site scripting vulnerabil... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-98099 In the Linux kernel, the following vulnerability has been resolved:
ipv6: mcast... |
medium | 4.7 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2023-0606 Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prio... |
medium | 6.1 | — | Ampache / ampache | 2023-02-01 | 2026-10-28 |
| CVE-2023-0062 The EAN for WooCommerce WordPress plugin before 4.4.3 does not validate and esca... |
medium | 5.4 | — | Wpfactory / ean for woocommerce | 2023-02-06 | 2026-10-28 |
| CVE-2023-0697 Inappropriate implementation in Full screen mode in Google Chrome on Android pri... |
medium | 6.5 | — | Google / chrome | 2023-02-07 | 2026-10-28 |
| CVE-2023-0704 Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481... |
medium | 6.5 | — | Google / chrome | 2023-02-07 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.