October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,689
Critical
3,236
High
7,696
Medium
7,353
Low
705
Severity not reported
4,699
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87085 Tanium addressed a SQL injection vulnerability in Provision. |
medium | 6.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2025-55640 A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of G... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2025-55653 GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2025-55654 A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pi... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-55667 A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-60480 A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/des... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-36061 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-36069 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-36252 IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diam... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-60475 A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) o... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-60494 A segmentation violation in the gf_props_equal_internal function (/filter_core/f... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-60496 A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-71437 Astral uv before 0.8.22 contains a path traversal vulnerability in source distri... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60479 A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_sta... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60489 A NULL pointer dereference in the dasher_insert_timeline_entry function (/filter... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-71438 An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Proj... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60478 A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_p... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60487 A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c)... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60490 A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filt... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60491 A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) o... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60492 A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60493 A segmentation violation in the check_media_profile function (/mp4box/mp4box.c)... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60497 A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Proj... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60469 A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_t... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-60476 A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptor... |
medium | 5.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-69723 A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2025-71439 llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama... |
medium | 5.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-86383 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 6.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86388 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
medium | 5.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93516 A use-after-free caused by lack of lifecycle management when adding / removing X... |
medium | 5.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which... |
medium | 4.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67079 HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an... |
medium | 6.4 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to imp... |
medium | 6.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117526 A vulnerability was found in reduxjs redux-devtools 5.0.0. |
medium | 5.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118271 A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118274 A vulnerability has been found in a2ui-project a2ui up to 0.10.6. |
medium | 4.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-69644 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-103602 Improper certificate validation in PkixNameConstraintValidator in Legion of the... |
medium | 5.3 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-70141 Out-of-bounds read in Microsoft Windows Search Component allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-87343 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
medium | 4.8 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.