October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,675
Critical
3,172
High
7,258
Medium
7,101
Low
646
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84713 A flaw was found in the automation-controller notification
subsystem. |
medium | 6.5 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-84721 A server-side request forgery flaw was found in the Ansible Automation Platform... |
medium | 6.4 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-71461 HostList.list() catches bare Exception and returns str(e)
verbatim. |
medium | 4.3 | — | — | 2026-09-23 | 2026-10-16 |
| CVE-2026-110593 BottleCRM through 1.14.5 contains a server-side template injection vulnerability... |
medium | 5.4 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110594 BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vu... |
medium | 4.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107635 Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk()... |
medium | 6.1 | — | — | 2026-10-08 | 2026-10-16 |
| CVE-2026-88130 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88129 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88125 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88123 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-88122 Out-of-bounds read in DNS Server allows an authorized attacker to deny service o... |
medium | 6.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96944 Insertion of sensitive information into externally-accessible file or directory... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97790 Improper link resolution before file access ('link following') in Windows Contai... |
medium | 5.5 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-105896 Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that c... |
medium | 5.5 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-111092 In JetBrains YouTrack before 2026.2.19575
2026.3.16075
2026.3.16397
2026.3.16402... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-93432 A flaw was found in the Quarkus Qute template engine. |
medium | 6.1 | — | — | 2026-09-18 | 2026-10-16 |
| CVE-2026-94451 Quarkus REST Data Panache provides a way to automatically generate REST endpoint... |
medium | 6.5 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-15890 The default AEAD nonce provider for the PSA Internal Trusted Storage transform m... |
medium | 5.3 | — | — | 2026-09-21 | 2026-10-15 |
| CVE-2026-97779 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97760 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97743 Use after free in Microsoft Office Excel allows an unauthorized attacker to disc... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97744 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97740 Exposure of sensitive system information to an unauthorized control sphere in Mi... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-97005 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88192 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88183 Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacke... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88184 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88167 Buffer over-read in Microsoft Office Word allows an unauthorized attacker to dis... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88169 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88175 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88154 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-70263 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-70206 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-110361 Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infini... |
medium | 6.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110364 Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement P... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-55840 Scoold is a Q&A and a knowledge sharing platform for teams. |
medium | 5.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-108499 Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase a... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-104198 ZoneMinder is a free, open source closed-circuit television software application... |
medium | 5.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110933 Uncaught exception vulnerability in Samsung Open Source Vyond allows Input Data... |
medium | 4.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110934 Improper validation of array index vulnerability in Samsung Open Source Vyond al... |
medium | 4.4 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.