October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,617
Critical
3,170
High
7,236
Medium
7,073
Low
640
Severity not reported
4,498
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (322), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117861 Sandbox escape in the DOM: Navigation component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117862 Privilege escalation due to incorrect boundary conditions in the Networking comp... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117863 Information disclosure due to uninitialized memory in the Audio/Video component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117864 Sandbox escape in the Form Manager component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117865 Use-after-free in the JavaScript: GC component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117866 Privilege escalation due to use-after-free in the Graphics: Canvas2D component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117867 Use-after-free in the Layout component. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116469 MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2024-36345 Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2026-18330 A hard-coded
cryptographic key vulnerability exists in the web module of TP-Link... |
not reported | — | — | — | 2026-09-03 | 2026-10-27 |
| CVE-2026-111054 Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2024-10085 CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exis... |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2024-7952 A data exposure vulnerability exists in the affected product. |
not reported | — | — | — | 2026-09-01 | 2026-10-27 |
| CVE-2024-7956 A vulnerability exists in the affected products that allows a threat actor to ga... |
not reported | — | — | — | 2026-09-02 | 2026-10-27 |
| CVE-2024-5540 The reflective cross-site scripting vulnerability found in ALC WebCTRL and Carri... |
not reported | — | — | — | 2025-11-27 | 2026-10-27 |
| CVE-2024-58291 Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows a... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-58293 Akaunting 3.1.8 contains a server-side template injection vulnerability that all... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-58306 minaliC 2.0.0 contains a denial of service vulnerability that allows remote atta... |
not reported | — | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-36315 Improper enforcement of the LFENCE serialization property may allow an attacker... |
not reported | — | — | — | 2026-05-13 | 2026-10-27 |
| CVE-2024-21962 Improper Input Validation in the AMD RAID driver could allow an attacker to poin... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-21950 An out of bounds read in the remote management firmware could allow a privileged... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-36323 Improper isolation of VCN-JPEG HW register space could allow a malicious Guest V... |
not reported | — | — | — | 2026-05-15 | 2026-10-27 |
| CVE-2024-24769 vantage6 is an open-source infrastructure for privacy preserving analysis. |
not reported | — | — | — | 2026-06-17 | 2026-10-27 |
| CVE-2024-27928 vantage6 is an open-source infrastructure for privacy preserving analysis. |
not reported | — | — | — | 2026-06-17 | 2026-10-27 |
| CVE-2026-99090 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-107458 Rejected reason: This CVE has been rejected by Upstream, as they failed to creat... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-115533 The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113644 In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-115216 In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verificat... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-105987 KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116591 compress provides various compression algorithms. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-101034 An attacker who obtained the hardcoded key could decrypt domain/service account... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-110737 The push endpoint of a Vaadin application that uses server push reflects the req... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-114409 Docker Desktop before version 4.97.0 could write third-party API keys and OAuth... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116627 Improper neutralization of input during web page generation ('Cross-site Scripti... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116583 Seroval facilitates JavaScript value stringification, including complex structur... |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-57196 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-111459 An improper certificate validation vulnerability exists in Moxa Remote Connect S... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111460 A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Ser... |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-111461 An OS command injection vulnerability exists in OnCell G3150A-LTE Series. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.