October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,039
Critical
3,131
High
7,102
Medium
6,936
Low
617
Severity not reported
4,253
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-19810 Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be s... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-46449 The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a... |
medium | 6.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50216 An integer underflow exists in the DNS proxy component of the macOS NetworkExten... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50217 A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guard... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-93635 LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allow... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104617 There are two invocations of `qrencode` to display a QR code for scanning. |
medium | 5.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104618 On request the `sdbootutil` script creates a world-readable debug log in /var/lo... |
medium | 6.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-16754 A potential improper certificate validation vulnerability was reported in Lenovo... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16755 A potential vulnerability was reported in Lenovo Smart Camera C33, distributed e... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89057 A potential authentication bypass vulnerability was reported in some Lenovo tabl... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89062 A potential out-of-bounds write vulnerability was reported in the Lenovo Energy... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92777 A potential vulnerability was reported in some Lenovo Tablets that could allow a... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85805 Improperly implemented security check for standard in Windows PowerShell allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96921 Access of resource using incompatible type ('type confusion') in Windows Message... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96925 Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96926 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96927 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Drive... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85815 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96321 Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96846 Out-of-bounds read in WebDAV allows an authorized attacker to disclose informati... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96848 Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96849 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96850 Use of uninitialized resource in Windows Modern Device Management (MDM) allows a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96851 Buffer over-read in Windows Management Instrumentation allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108580 AniWorld Downloader before 5.3.0 contains an improper restriction of authenticat... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108586 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorizati... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108595 Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108600 open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link f... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108688 Eladmin through 2.7 contains a missing authorization vulnerability in the LocalS... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108699 hyper-mcp through 0.8.3 contains an improper signature verification vulnerabilit... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-109320 The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-111212 A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alph... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111096 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-111095 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-108162 Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that al... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108163 Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerabilit... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 contains an insecure direct objec... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnera... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108554 PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.