October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-98949 In the Linux kernel, the following vulnerability has been resolved:
drm/imagina... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98951 In the Linux kernel, the following vulnerability has been resolved:
riscv: ptra... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98953 In the Linux kernel, the following vulnerability has been resolved:
devlink: fi... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98954 In the Linux kernel, the following vulnerability has been resolved:
net: always... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98946 In the Linux kernel, the following vulnerability has been resolved:
drm/vc4: Di... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98947 In the Linux kernel, the following vulnerability has been resolved:
vsock: Fix... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98948 In the Linux kernel, the following vulnerability has been resolved:
mlxsw: spec... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98938 In the Linux kernel, the following vulnerability has been resolved:
rust: irq:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98939 In the Linux kernel, the following vulnerability has been resolved:
x86/mm: Dro... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98924 In the Linux kernel, the following vulnerability has been resolved:
fs: avoid r... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98925 In the Linux kernel, the following vulnerability has been resolved:
bpf, sockma... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98928 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98929 In the Linux kernel, the following vulnerability has been resolved:
macsec: ini... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98930 In the Linux kernel, the following vulnerability has been resolved:
KVM: s390:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98918 In the Linux kernel, the following vulnerability has been resolved:
mm/damon/op... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98919 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: har... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98920 In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98921 In the Linux kernel, the following vulnerability has been resolved:
ovl: fix UA... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98922 In the Linux kernel, the following vulnerability has been resolved:
net: emac:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98923 In the Linux kernel, the following vulnerability has been resolved:
arm64: io:... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-98871 In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp... |
not reported | — | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-89410 In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-66279 In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write ac... |
not reported | — | — | — | 2026-10-21 | 2026-10-23 |
| CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoin... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115516 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log d... |
not reported | — | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113664 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113669 ApostropheCMS is an open-source Node.js content management system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113712 Cachet is an open-source status page system. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-113715 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-111756 follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically f... |
not reported | — | — | — | 2026-10-20 | 2026-10-23 |
| CVE-2026-55644 Element X iOS is a Matrix iOS Client provided by Element. |
not reported | — | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111063 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-111749 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. |
not reported | — | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-89409 In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and ear... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-16477 CleanShot X for macOS insecurely deserializes untrusted data embedded in a .clea... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115494 A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115496 Overly informative error messages in the catalog functionality of KNIME Business... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-115502 A missing authorization check allows anyone having access to a "link without log... |
not reported | — | — | — | 2026-10-22 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.