October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,730
Critical
3,173
High
7,275
Medium
7,124
Low
648
Severity not reported
4,510
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96926 Missing authorization in DNS Server allows an authorized attacker to perform tam... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96927 Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose inf... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85812 Files or directories accessible to external parties in Windows Bind Filter Drive... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85815 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96321 Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacke... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96846 Out-of-bounds read in WebDAV allows an authorized attacker to disclose informati... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96848 Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96849 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96850 Use of uninitialized resource in Windows Modern Device Management (MDM) allows a... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96851 Buffer over-read in Windows Management Instrumentation allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108580 AniWorld Downloader before 5.3.0 contains an improper restriction of authenticat... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108586 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorizati... |
medium | 5.4 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108595 Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108600 open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link f... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108688 Eladmin through 2.7 contains a missing authorization vulnerability in the LocalS... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108699 hyper-mcp through 0.8.3 contains an improper signature verification vulnerabilit... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-109320 The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-111212 A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alph... |
medium | 4.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111096 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-111095 In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the cla... |
medium | 5.4 | — | Jetbrains / teamcity | 2026-10-15 | 2026-10-16 |
| CVE-2026-108162 Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that al... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108163 Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerabilit... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108164 Open Source Social Network (OSSN) through 10.1 contains an insecure direct objec... |
medium | 6.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108115 Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnera... |
medium | 4.9 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108554 PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108555 PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP tha... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108582 GenOffice through 0.11.505 contains an incorrect permissions vulnerability in it... |
medium | 5.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108583 zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerab... |
medium | 4.2 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108592 mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerabili... |
medium | 5.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108599 phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that... |
medium | 4.7 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108604 Tabularis through 0.27.0 contains an incorrect authorization vulnerability in th... |
medium | 6.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-108690 mall4j through 4.0 contains an information disclosure vulnerability that allows... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108691 mall4j through 4.0 contains an improper authorization vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108696 CoreShop through 1.5.5 contains an authorization bypass vulnerability in the Ord... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108706 eladmin through commit 55fbf70 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108710 NornicDB through 1.4.1 contains a missing authorization vulnerability that allow... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108711 Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerabil... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108712 SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerabilit... |
medium | 4.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability... |
medium | 5.3 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108717 Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability... |
medium | 6.3 | — | — | 2026-10-11 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.