October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,281
Critical
3,225
High
7,606
Medium
7,217
Low
653
Severity not reported
4,580
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113122 Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-97783 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 6.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-21 |
| CVE-2026-113002 Memory corruption in Transactions Platform in Google Chrome prior to 156.0.8078.... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-83870 Out-of-bounds read in Windows Aggregated Data Platform Service allows an authori... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-113066 Memory corruption in Fonts in Google Chrome prior to 156.0.8078.47 allowed a rem... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113070 Out of bounds read in GetUserMedia in Google Chrome prior to 156.0.8078.47 allow... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113296 Memory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a rem... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113297 Improper access control in Ozone in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113309 Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a re... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113310 Out of bounds read in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113322 Memory corruption in Dawn in Google Chrome prior to 156.0.8078.47 allowed a remo... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-113333 Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-93744 IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to by... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-87800 IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker... |
medium | 6.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-114105 Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability t... |
medium | 6.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114075 Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that al... |
medium | 5.4 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114080 Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerabil... |
medium | 5.0 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114095 Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114065 Trigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that a... |
medium | 6.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114039 A weakness has been identified in projectworlds Advanced Library Management Syst... |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113710 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.9 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113740 A flaw has been found in itsourcecode Online Cake Ordering System 1.0. |
medium | 6.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113680 HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerabi... |
medium | 5.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113656 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113661 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
medium | 5.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113598 Modoboa before 2.8.0 contains an insecure direct object reference vulnerability... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113603 The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 Py... |
medium | 6.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113608 Configurable Reports block for Moodle (moodle-block_configurablereports) before... |
medium | 5.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113652 ApostropheCMS is an open-source Node.js content management system. |
medium | 5.6 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113359 Baserow before 2.3.0 contains a missing authorization vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112952 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-112957 ApostropheCMS is an open-source Node.js content management system. |
medium | 4.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113129 Improper access control in Extensions in Google Chrome prior to 156.0.8078.47 al... |
medium | 6.5 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-106577 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 6.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-83854 Improper access control in Windows Notification allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-107210 ImageMagick is free and open-source software used for editing and manipulating d... |
medium | 5.3 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-107389 music-metadata is a metadata parser for audio and video media files. |
medium | 5.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-21 |
| CVE-2026-83864 Improper access control in Windows NTFS allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.