October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,570
Critical
3,231
High
7,671
Medium
7,315
Low
699
Severity not reported
4,654
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70011 Out-of-bounds read in Windows IP Over USB Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-109941 FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_pack... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-91523 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91524 Vulnerability in the Oracle Business Intelligence Enterprise Edition product of... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91526 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
medium | 4.7 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91518 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91514 Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component:... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-81509 nforwardauth is a forward auth service that allows the use of a single authentic... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33522 Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated a... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-50095 There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earl... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-50096 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116541 Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerabil... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability t... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-33520 There is a reflected cross site scripting vulnerability in Esri Portal for ArcGI... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116371 A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116154 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in i... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115919 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115920 Open Neural Network Exchange (ONNX) is an open standard for machine learning int... |
medium | 6.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115720 Frappe Builder before 1.36.1 contains a server-side request forgery vulnerabilit... |
medium | 5.0 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115804 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
medium | 6.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote c... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115380 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
medium | 4.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115381 Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains... |
medium | 4.8 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115385 Wasmtime 46.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a denial of serv... |
medium | 6.2 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-112955 ApostropheCMS is an open-source Node.js content management system. |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-114458 A flaw was found in mod_qos. |
medium | 5.9 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-110100 Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts:... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110105 B3log Symphony through 3.6.4 contains a missing authorization vulnerability that... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110110 JetLinks Community through 2.10.0 contains a missing authorization vulnerability... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110117 SmartAdmin through 3.30.0 contains a missing authorization vulnerability in Admi... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110122 PickMall lilishop through 4.4 contains an insecure direct object reference vulne... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110127 waynboot-mall through 2.0.0 contains an insecure direct object reference vulnera... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109966 yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that al... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-108462 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-108466 Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny ser... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardRelea... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-84727 Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.1... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-87849 The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) cal... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.