October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,717
Critical
3,173
High
7,271
Medium
7,122
Low
648
Severity not reported
4,503
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69947 Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized atta... |
medium | 6.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85336 Out-of-bounds read in Windows Device Association Service allows an authorized at... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69940 Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-109339 SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory becau... |
medium | 4.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-110603 LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_heade... |
medium | 6.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-85374 Out-of-bounds read in Windows Installer allows an authorized attacker to disclos... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85793 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2022-51020 Flower before 2.2.0 contains a cross-site request forgery vulnerability because... |
medium | 5.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109379 Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that... |
medium | 5.3 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109562 SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability t... |
medium | 5.4 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-109438 3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitiali... |
medium | 5.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110877 AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoade... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-110878 Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111126 catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK re... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111127 catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111128 Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Og... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111131 libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerabili... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111133 libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encryp... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111136 libInstPatch through 1.1.7 contains a heap out-of-bounds write vulnerability in... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111137 libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAs... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111138 NetSurf libnsbmp through 0.1.7 contains an out-of-bounds read vulnerability in b... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111143 Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111146 ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in MAPIPrin... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111148 libsidplayfp through 3.1.1 contains a heap out-of-bounds read vulnerability that... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111151 OpenJPH through 0.32.0 contains a heap out-of-bounds write vulnerability in the... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111152 Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnera... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111153 Game Music Emu (libgme) through 0.6.5 contains a global out-of-bounds read vulne... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111156 libTiMidity through 0.2.8 contains an out-of-bounds access vulnerability in init... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111158 EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerabili... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111161 libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds writ... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111162 WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the H... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111163 WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_P... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111166 libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111167 GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerabilit... |
medium | 6.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111168 LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111171 Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 contains a server-side r... |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111234 SimplePie through 1.9.0 contains a local file read vulnerability that allows mal... |
medium | 5.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111271 libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerabilit... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111272 LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseN... |
medium | 5.5 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.