October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,620
Critical
3,170
High
7,238
Medium
7,074
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14552 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.0... |
medium | 4.3 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-69922 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-70214 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to... |
medium | 5.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-102867 Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to d... |
medium | 6.5 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-14509 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
medium | 5.9 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-102859 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70259 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102865 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102864 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105720 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105719 Improper input validation in Microsoft Office SharePoint allows an authorized at... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105713 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
medium | 5.7 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70217 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.9 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85932 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70298 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
medium | 6.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88209 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88208 Improper neutralization of input during web page generation ('cross-site scripti... |
medium | 4.6 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-94587 A buffer overflow vulnerability exists in the WebTools administrative interface... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94586 A command injection vulnerability exists in the WebTools administrative interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94581 An OS command injection vulnerability exists in the REST API management interfac... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87677 An OS command injection vulnerability exists in the account management subsystem... |
medium | 6.6 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87663 An authentication bypass and command injection vulnerability exists in the inter... |
medium | 6.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87662 Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of sp... |
medium | 6.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87661 Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly ac... |
medium | 5.7 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-110150 Privilege elevation in Installer in Google Chrome on on Windows prior to 155.0.8... |
medium | 5.5 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2023-5649 An Improper Input Validation vulnerability for the registered case credentials i... |
medium | 5.5 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2023-5648 In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers... |
medium | 6.1 | — | Broadcom / brocade active support connectivity gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-86348 Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from... |
medium | 4.3 | — | Mattermost / mattermost server | 2026-09-14 | 2026-10-14 |
| CVE-2026-5049 A path traversal vulnerability affects the The Zone Alias Import flow feature in... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-5047 A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwor... |
medium | 5.7 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-7767 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11... |
medium | 5.8 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-67165 HCL Connections is vulnerable to a cross-site scripting attack where an attacker... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-14532 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107606 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107607 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102502 CAI Content Credentials is affected by an Improper Verification of Cryptographic... |
medium | 5.3 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-100755 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.2... |
medium | 4.6 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-101168 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.0... |
medium | 6.2 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-87688 An input validation vulnerability exists in the security certificate management... |
medium | 6.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94580 An arbitrary file and directory deletion vulnerability exists in the REST API ma... |
medium | 4.5 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.