October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,416
Critical
3,281
High
7,882
Medium
7,582
Low
740
Severity not reported
4,931
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86002 Dokku is a docker-powered platform as a service. |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-85714 Stirling-PDF is a locally hosted web application that facilitates various operat... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-88092 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.4 | — | Microsoft / asp.net core | 2026-10-13 | 2026-10-16 |
| CVE-2026-88102 Use after free in Windows Failover Cluster allows an unauthorized attacker to ex... |
critical | 9.8 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96320 Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacke... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-69227 A flaw in Portal for ArcGIS allows unauthenticated access to
certain Portal Ad... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-94134 The Apache Airflow SSH provider hook disables SSH host-key verification by defau... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111444 Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escapi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-94169 Improper Control of Generation of Code ('Code Injection') vulnerability in Theme... |
critical | 10.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-94388 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109515 The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, A... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-108497 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104730 The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographer... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103768 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102175 A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102031 An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101954 An Improper Authentication vulnerability in the J-Web management interface and i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101982 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-96909 Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96659 A flaw was found in Foreman. |
critical | 9.1 | — | Redhat / satellite | 2026-10-01 | 2026-10-16 |
| CVE-2026-96113 Heap-based buffer overflow in DNS Server allows an unauthorized attacker to exec... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96934 Use after free in Windows DHCP Server allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87744 A flaw was found in Quarkus REST Data Panache. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-1678 dns_unpack_name() caches the buffer tailroom once and reuses it while appending... |
critical | 9.8 | — | Zephyrproject / zephyr | 2026-03-05 | 2026-10-15 |
| CVE-2026-88178 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-88156 Stack-based buffer overflow in Microsoft Office Outlook allows an unauthorized a... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-70291 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-57155 OPNsense is a FreeBSD based firewall and routing platform. |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-102238 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78357 Previously issued authentication tokens are not immediately invalidated when an... |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-93582 The HTTP Basic Authentication modules in ((OTRS)) Community Edition 6 and prior... |
critical | 9.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-89107 SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validat... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89108 SAP Manufacturing Integration and Intelligence does not sufficiently enforce aut... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89110 SAP NetWeaver Visual Composer does not perform sufficient authorization checks i... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89111 The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting mul... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-44415 Affected systems do not properly restrict access to internal APIs and paths for... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63350 Affected devices do not properly restrict executable content contained in import... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63353 Affected devices do not properly sanitize comment fields contained in imported t... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109755 Sandbox escape in the DOM: Content Processes component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102946 joserfc is a Python library that provides an implementation of several JSON Obje... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.