October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,426
Critical
3,227
High
7,633
Medium
7,252
Low
684
Severity not reported
4,630
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-11829 IBM MQ could allow an authenticated attacker to cause a denial of service due to... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-110834 FreeRDP from 2.0.0 before 3.32.0 contains a null pointer dereference vulnerabili... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110835 FreeRDP 3.0.0 before 3.32.0 allows HTTP header injection in its proxy because a... |
medium | 5.8 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110836 FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in http... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110832 FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110831 FreeRDP versions 3.13.0 before 3.32.0 contain a resource retention flaw in drive... |
medium | 4.3 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-91411 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91412 Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91399 Vulnerability in the Primavera P6 Enterprise Project Portfolio Management produc... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-91404 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
medium | 4.0 | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111384 Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dash... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-110829 FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-105265 A vulnerability exists in the the time zone parameter and does not properly vali... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111100 The ONVIF device service on the E3 responds to certain informational requests wi... |
medium | 5.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-96616 Authentication tokens issued by the E3's web management interface on login are g... |
medium | 6.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115754 serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vul... |
medium | 4.7 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-86020 Part-DB is an open source inventory management system for electronic components. |
medium | 4.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-113876 SmileCDR HAPI FHIR does not correctly check authorization for conditional create... |
medium | 4.3 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111603 PlayEdu through 2.3 contains a missing authorization vulnerability in the Course... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111608 Jeepay through 3.2.9 contains an insecure direct object reference vulnerability... |
medium | 4.2 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111618 CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnera... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111623 Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulner... |
medium | 5.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-111628 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that... |
medium | 5.0 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-98090 In the Linux kernel, the following vulnerability has been resolved:
btrfs: rest... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-98094 In the Linux kernel, the following vulnerability has been resolved:
staging: fb... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-98091 In the Linux kernel, the following vulnerability has been resolved:
btrfs: deta... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-98092 In the Linux kernel, the following vulnerability has been resolved:
ASoC: amd:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-110804 Improperly controlled modification of JIT elevation settings in PAM checkout in... |
medium | 4.3 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-110806 Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 an... |
medium | 6.5 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-113157 Information leak in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-23 |
| CVE-2026-110287 Improper access control in asset contact password in Devolutions Server 2026.3.8... |
medium | 4.3 | — | Devolutions / devolutions server | 2026-10-16 | 2026-10-23 |
| CVE-2026-98095 In the Linux kernel, the following vulnerability has been resolved:
af_packet:... |
medium | 5.5 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-69506 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-12343 IBM MQ could allow an authenticated attacker to cause a denial of service due to... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12350 IBM MQ could allow an authenticated attacker to cause a denial of service by sen... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12669 IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds re... |
medium | 4.3 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-12670 IBM MQ could allow an authenticated attacker to cause a denial of service throug... |
medium | 6.5 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-111653 53AIHub through 0.5.3 contains a missing authentication vulnerability that allow... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-109433 Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorizatio... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-23 |
| CVE-2026-12727 IBM MQ could allow an authenticated attacker to cause potential process instabil... |
medium | 4.3 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.