October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,675
Critical
3,172
High
7,258
Medium
7,101
Low
646
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107844 Contao is an Open Source CMS. |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107850 Contao is an Open Source CMS. |
medium | 4.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-24723 A NULL pointer dereference vulnerability has been reported to affect File Statio... |
medium | 6.5 | — | Qnap / file station | 2026-10-15 | 2026-10-16 |
| CVE-2026-107825 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 4.0 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107833 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.9 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107834 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 5.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107835 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
medium | 4.0 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-34015 A path traversal vulnerability has been reported to affect Video Station. |
medium | 6.5 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-87714 Missing authorization in WebDAV allows an authorized attacker to bypass a securi... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-67239 RabbitMQ is a messaging and streaming broker. |
medium | 5.4 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-67241 RabbitMQ is a messaging and streaming broker. |
medium | 6.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-96935 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96930 Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) al... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-67242 RabbitMQ is a messaging and streaming broker. |
medium | 5.4 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-96311 Improper authorization in Windows Network List Service allows an authorized atta... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96314 Out-of-bounds read in Windows Audio Service allows an authorized attacker to dis... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96315 Missing authorization in Windows Overlay Filter allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96316 Improper access control in Windows Routing and Remote Access Service (RRAS) allo... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96247 Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorize... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96218 Improper access control in Windows Update Stack allows an authorized attacker to... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-95904 Buffer over-read in Windows Event Logging Service allows an authorized attacker... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-93767 The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all ve... |
medium | 6.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85473 The auth0/java-jwt library may terminate a thread if it receives a JWT with a ti... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83776 Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker... |
medium | 6.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-78633 The Okta RADIUS Agent does not validate the sub-attribute length when parsing a... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-75083 The receive path of the NXP KW41Z IEEE 802.15.4 driver, kw41z_rx() in drivers/ie... |
medium | 5.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-75084 The CC1200 sub-GHz IEEE 802.15.4 driver takes the PHY packet length from the fir... |
medium | 6.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-75085 The STM32WBA IEEE 802.15.4 driver in drivers/ieee802154/ieee802154_stm32wba.c co... |
medium | 4.2 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-70244 Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose inf... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-59508 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
medium | 5.9 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19737 i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested dir... |
medium | 5.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19738 The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected I... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-19739 The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/l... |
medium | 6.5 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-108925 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu... |
medium | 6.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-110467 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulne... |
medium | 4.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110019 The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authoriz... |
medium | 4.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107437 GV-E-Map
Server V18.2.0A contains a plaintext database password embedded within... |
medium | 6.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-106170 An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSan... |
medium | 4.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-107605 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103480 The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for W... |
medium | 6.4 | — | — | 2026-10-16 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.