October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,692
Critical
3,236
High
7,698
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-114388 Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a mi... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114253 A vulnerability was determined in oretnom23 file-management-system-php up to 2e3... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114250 A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114104 adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability tha... |
medium | 5.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114099 Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested pr... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113721 virtualenv is a tool for creating isolated virtual python environments. |
medium | 4.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-109972 The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywa... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109236 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-107625 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103996 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103404 An Incorrect Permission Assignment for Critical Resource vulnerability in Routin... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103405 An Improper Neutralization of Special Elements in Output Used by a Downstream Co... |
medium | 5.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103393 An Out-of-Bounds Read vulnerability in the VRRP implementation in Juniper Networ... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103391 An Out-of-bounds Write vulnerability in the SSR TCP proxy/optimization path in J... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-103392 An Out-of-Bounds Write vulnerability in the TCP header processing in Juniper Net... |
medium | 4.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2023-38472 A vulnerability was found in Avahi. |
medium | 5.5 | — | Avahi / avahi | 2023-11-02 | 2026-10-28 |
| CVE-2023-38473 A vulnerability was found in Avahi. |
medium | 5.5 | — | Avahi / avahi | 2023-11-02 | 2026-10-28 |
| CVE-2024-52615 A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-ar... |
medium | 5.3 | — | — | 2024-11-21 | 2026-10-28 |
| CVE-2024-52616 A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs r... |
medium | 5.3 | — | — | 2024-11-21 | 2026-10-28 |
| CVE-2023-38469 A vulnerability was found in Avahi, where a reachable assertion exists in avahi_... |
medium | 5.5 | — | Avahi / avahi | 2023-11-02 | 2026-10-28 |
| CVE-2023-38470 A vulnerability was found in Avahi. |
medium | 5.5 | — | Avahi / avahi | 2023-11-02 | 2026-10-28 |
| CVE-2023-38471 A vulnerability was found in Avahi. |
medium | 5.5 | — | Avahi / avahi | 2023-11-02 | 2026-10-28 |
| CVE-2014-125136 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engin... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2014-125132 Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site s... |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-70122 Time-of-check time-of-use (toctou) race condition in Windows Broadcast DVR User... |
medium | 6.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70280 Incorrect authorization in Windows Hello allows an authorized attacker to bypass... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70135 Out-of-bounds read in Windows Remote POS Driver allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70137 Improper access control in Windows Remote Access Connection Manager allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70148 Improper authorization in Windows Broadcast DVR User Service allows an authorize... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70116 Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an un... |
medium | 4.2 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70208 Out-of-bounds read in Windows HTTP.sys allows an authorized attacker to disclose... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96865 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-96863 Heap-based buffer overflow in Windows Storage Port Driver allows an unauthorized... |
medium | 6.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70216 Insufficient granularity of access control in Windows Mobile Device Management a... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70005 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70227 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70235 Improper authentication in Windows Event Tracing allows an authorized attacker t... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70248 Null pointer dereference in Windows Hyper-V allows an authorized attacker to den... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70055 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.