October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,692
Critical
3,236
High
7,698
Medium
7,354
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70057 Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70063 Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose i... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70072 Allocation of resources without limits or throttling in Windows Netlogon allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70075 Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Base... |
medium | 4.4 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70077 Use after free in Windows Kernel allows an authorized attacker to disclose infor... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70084 Improper access control in Windows Projected File System allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70090 Use of uninitialized resource in Windows Netlogon allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-92098 The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vul... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-76058 The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authori... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118164 The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116610 The Clean Login plugin for WordPress is vulnerable to Missing Authorization in v... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114074 Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability t... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114076 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerabil... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114079 Trigger.dev before 4.5.6 contains an improper authorization vulnerability that a... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114086 Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114054 vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authentic... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114056 ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerabili... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114061 SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerabi... |
medium | 4.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114064 Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in th... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114041 FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cl... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114044 FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the An... |
medium | 5.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114046 FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112898 Pillow is a Python imaging library. |
medium | 5.3 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112911 filelock is a platform-independent file lock for Python. |
medium | 6.3 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-28 |
| CVE-2026-113705 A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-107710 The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPre... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109980 The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive... |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Goo... |
medium | 5.9 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2021-48020 Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability cause... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-98114 In the Linux kernel, the following vulnerability has been resolved:
ksmbd: prop... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-116175 vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability becau... |
medium | 6.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116187 Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerabilit... |
medium | 5.0 | — | Rclone / rclone | 2026-10-25 | 2026-10-28 |
| CVE-2026-116188 rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulner... |
medium | 5.3 | — | Rclone / rclone | 2026-10-25 | 2026-10-28 |
| CVE-2026-84496 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-116891 SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116875 SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116874 SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site script... |
medium | 6.1 | — | Semantic-mediawiki / semantic mediawiki | 2026-10-27 | 2026-10-28 |
| CVE-2026-116680 HomeBox is a home inventory and organization system. |
medium | 6.4 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117608 Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::... |
medium | 6.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118435 Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer... |
medium | 5.4 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.