October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,316
Critical
3,226
High
7,610
Medium
7,220
Low
656
Severity not reported
4,604
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-20197 Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo De... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20221 Multiple Cisco products are affected by a vulnerability in the generic routing e... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20011 Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20019 Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow D... |
medium | 5.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-106491 Backstage is an open framework for building developer portals. |
medium | 6.4 | — | Linuxfoundation / backstage\/plugin-proxy-backend | 2026-10-06 | 2026-10-22 |
| CVE-2026-113223 Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113225 Memory corruption in Browser in Google Chrome on on Android prior to 156.0.8078.... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113237 Memory corruption in Chromoting in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-106492 Backstage is an open framework for building developer portals. |
medium | 6.5 | — | Linuxfoundation / backstage\/backend-defaults | 2026-10-06 | 2026-10-22 |
| CVE-2026-106493 Backstage is an open framework for building developer portals. |
medium | 4.1 | — | Linuxfoundation / backstage | 2026-10-06 | 2026-10-22 |
| CVE-2026-106494 Backstage is an open framework for building developer portals. |
medium | 4.9 | — | Linuxfoundation / backstage\/backend defaults | 2026-10-06 | 2026-10-22 |
| CVE-2026-70170 Untrusted pointer dereference in Windows Kernel allows an authorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-106564 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-22 |
| CVE-2026-70199 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70232 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-84284 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11... |
medium | 5.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-22 |
| CVE-2026-113246 Memory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.4... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113277 Out of bounds read in CustomTabs in Google Chrome on on Android prior to 156.0.8... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113341 Memory corruption in Skia in Google Chrome on on Android prior to 156.0.8078.47... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113340 Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113329 Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.4... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113326 Memory corruption in Core in Google Chrome on on Windows prior to 156.0.8078.47... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113325 Memory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 al... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113304 Memory corruption in GPU in Google Chrome on on Android prior to 156.0.8078.47 a... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-113295 Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.4... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-115326 QloApps through 1.7.0 contains an insecure direct object reference vulnerability... |
medium | 5.4 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-114176 Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webin... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-112868 Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p al... |
medium | 4.3 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2017-20290 Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site script... |
medium | 6.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-86332 A flaw was found in odh-dashboard in Red Hat OpenShift AI. |
medium | 6.5 | — | — | 2026-09-07 | 2026-10-22 |
| CVE-2026-112293 BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorizatio... |
medium | 5.4 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112329 The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control v... |
medium | 4.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112268 sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass... |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112273 libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::com... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112278 rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in proce... |
medium | 6.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112283 VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vuln... |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112091 A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42... |
medium | 5.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. |
medium | 5.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. |
medium | 6.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112049 Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in i... |
medium | 5.5 | — | — | 2026-10-18 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.