October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,384
Critical
3,278
High
7,871
Medium
7,568
Low
735
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-92119 REST API Mass Assignment vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92120 OAuth1 Request Replay Attack vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-89079 The Theme My Login plugin for WordPress is vulnerable to privilege escalation vi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85499 Improper Authorization vulnerability in Apache SkyWalking BanyanDB. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-76284 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contai... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108929 A flaw has been found in Netcore NR268 1.7.121109. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104798 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-69886 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-106612 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-109390 AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrar... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-97816 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97814 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97815 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97805 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-102178 A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107845 Contao is an Open Source CMS. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to exe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficientl... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-96219 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96096 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83869 Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83782 Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to e... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83770 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-70096 Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthori... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-69705 Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-107373 ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typem... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103501 Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C+... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103513 Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSke... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-103635 Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSke... |
critical | 9.1 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-77366 obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidia... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-57118 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102989 TanStack Router is a client-first, server-capable, fully type-safe router and fu... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-94603 Podman is a tool for managing OCI containers and pods. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-86002 Dokku is a docker-powered platform as a service. |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-85714 Stirling-PDF is a locally hosted web application that facilitates various operat... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.4 | — | Microsoft / asp.net core | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.