October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,565
Critical
3,231
High
7,668
Medium
7,313
Low
699
Severity not reported
4,654
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109561 goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability t... |
medium | 4.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-10759 A flaw in Portal for ArcGIS could allow LDAP injection through administrative fu... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-98144 In the Linux kernel, the following vulnerability has been resolved:
accel/amdxd... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-26 |
| CVE-2026-98145 In the Linux kernel, the following vulnerability has been resolved:
accel/amdxd... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-26 |
| CVE-2026-69968 Relative path traversal in Windows Libarchive allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69969 Improper link resolution before file access ('link following') in Windows AppX D... |
medium | 4.7 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69971 Incorrect authorization in Windows Kernel-Mode Drivers allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69973 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69974 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to di... |
medium | 4.7 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69978 Null pointer dereference in Windows VMSwitch allows an authorized attacker to de... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69979 Improper protection of alternate path in Windows AppX Deployment Service allows... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69982 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
medium | 5.9 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-94402 IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. |
medium | 6.1 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-78801 An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-76304 In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a r... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-76308 In Splunk SOAR versions below 8.7.0, an authenticated user could change the Ente... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contai... |
medium | 5.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116259 A security flaw has been discovered in libimobiledevice up to 1.4.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116262 A vulnerability was detected in libimobiledevice up to 1.4.0. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116224 A vulnerability has been found in fr0tt benotes up to 2.8.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116213 Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability i... |
medium | 4.9 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116217 RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability... |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116203 YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the... |
medium | 6.1 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116167 SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in... |
medium | 6.8 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116139 WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerabi... |
medium | 5.4 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116155 ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in t... |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116120 A vulnerability was determined in NocoDB up to 2026.07.0. |
medium | 5.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116096 A weakness has been identified in ggml-org llama.cpp. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116102 A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. |
medium | 6.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116108 A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116053 A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. |
medium | 5.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116056 A flaw has been found in KodCloud KodExplorer up to 4.56. |
medium | 6.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116063 A weakness has been identified in DedeCMS up to 5.7.118. |
medium | 4.7 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-115718 Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vuln... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115679 Arm Keil MDK-Middleware 8.3.0 may allow out-of-bounds reads and writes to the FT... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115680 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and... |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115221 A flaw was found in FreeIPA. |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115678 Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow pre-authentication out-of-bounds r... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110733 Vulnerability in the SQL storage module of Apache SIS. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-110270 OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.