October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,730
Critical
3,173
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-68908 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107857 Mindwtr is a free offline-first task management application for desktop and mobi... |
medium | 4.4 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTT... |
medium | 6.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102672 Electron is a framework for writing cross-platform desktop applications using Ja... |
medium | 6.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-15577 A user or service account with read-only access to Git Sync (provisioning) conne... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-33374 The Prometheus rule conversion API endpoints in Grafana do not limit request bod... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-93294 A user with query access to an Azure Monitor data source can use its resource pr... |
medium | 6.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-95502 A Git server that Grafana's Git Sync (provisioning) is configured to use can exh... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-86607 Internal Application Information Exposure Vulnerability in Hitachi Ops Center Ad... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102740 The AsyncHttpClient library allows Java applications to execute HTTP requests an... |
medium | 5.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-107777 Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which co... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85816 Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disc... |
medium | 5.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108978 Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Bu... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-65199 openUBMC assigns the full privilege set to pseudo-identities representing SNMP c... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-104587 blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110451 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110452 The multi-user installer in Nix before 2.35.3 sets the ownership of store conten... |
medium | 4.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110904 ApostropheCMS before 4.33.0 allows authentication bypass for REST API page readi... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-95180 An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local att... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-78851 Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remot... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106707 XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerabil... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-85821 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-66085 In modem, there is a possible information disclosure due to missing filtering of... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-87765 In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardw... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109786 In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-19810 Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be s... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-46449 The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a... |
medium | 6.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50216 An integer underflow exists in the DNS proxy component of the macOS NetworkExten... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-50217 A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guard... |
medium | 4.7 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-93635 LDAP filter injection in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allow... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104617 There are two invocations of `qrencode` to display a QR code for scanning. |
medium | 5.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104618 On request the `sdbootutil` script creates a world-readable debug log in /var/lo... |
medium | 6.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-16754 A potential improper certificate validation vulnerability was reported in Lenovo... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-16755 A potential vulnerability was reported in Lenovo Smart Camera C33, distributed e... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89057 A potential authentication bypass vulnerability was reported in some Lenovo tabl... |
medium | 6.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-89062 A potential out-of-bounds write vulnerability was reported in the Lenovo Energy... |
medium | 5.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-92777 A potential vulnerability was reported in some Lenovo Tablets that could allow a... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85805 Improperly implemented security check for standard in Windows PowerShell allows... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96921 Access of resource using incompatible type ('type confusion') in Windows Message... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96925 Integer underflow (wrap or wraparound) in Windows NTFS allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.