October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,717
Critical
3,173
High
7,271
Medium
7,122
Low
648
Severity not reported
4,503
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110597 Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseE... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110598 Libyal libpff through 20260926 contains an integer underflow in libpff_record_en... |
medium | 6.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110602 libmspack through 0.11alpha contains an uninitialized pointer free vulnerability... |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110607 BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypas... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110617 we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /a... |
medium | 4.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110629 VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerabi... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110712 libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_dec... |
medium | 6.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110716 unshield through 1.6.2 contains a heap out-of-bounds read vulnerability in unshi... |
medium | 5.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-89279 Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78335 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
medium | 4.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-16 |
| CVE-2026-79607 During Xenstore live update the state record for a Xenstore watch with
specified... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108129 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-111697 HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111707 99AI through 4.3.0 contains an insecure direct object reference vulnerability th... |
medium | 5.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111712 Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerabili... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111717 Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111323 RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vu... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111347 go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in th... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111667 REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskComm... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111672 Cube-studio through 2026.09.01 contains a missing authorization vulnerability in... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105836 QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminPro... |
medium | 5.4 | — | — | 2026-10-06 | 2026-10-16 |
| CVE-2026-108674 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Op... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103500 An attacker could cause a heap buffer overflow by getting a user to open an emai... |
medium | 6.1 | — | Mozilla / thunderbird | 2026-09-30 | 2026-10-16 |
| CVE-2026-108128 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108127 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70044 Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108114 Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability th... |
medium | 4.3 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-109355 LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in g... |
medium | 6.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109596 Hugo from v0.162.0 before v0.167.0 contains an improper link resolution vulnerab... |
medium | 5.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109597 Hugo from v0.60.0 before v0.167.0 contains a stored cross-site scripting vulnera... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110652 ONLYOFFICE DocumentServer before 10.0.0 contains an unauthenticated server-side... |
medium | 4.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110717 Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-70041 Buffer over-read in Windows CD-ROM Driver allows an authorized attacker to discl... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70025 Use after free in Windows Netlogon allows an authorized attacker to deny service... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-70017 Access of resource using incompatible type ('type confusion') in Windows Secure... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69958 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69955 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69954 Buffer over-read in Windows Overlay Filter allows an authorized attacker to disc... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85337 Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-110608 BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object re... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.