October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,452
Critical
3,282
High
7,901
Medium
7,592
Low
741
Severity not reported
4,936
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the re... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-103059 When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the pre... |
critical | 9.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-15 |
| CVE-2026-78308 Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass... |
critical | 9.8 | — | — | 2026-09-24 | 2026-10-15 |
| CVE-2025-3277 An integer overflow can be triggered in SQLite’s `concat_ws()` function. |
critical | 9.8 | — | Sqlite / sqlite | 2025-04-14 | 2026-10-15 |
| CVE-2024-47685 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
critical | 9.1 | — | Debian / debian linux | 2024-10-21 | 2026-10-15 |
| CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local atta... |
critical | 9.0 | — | Freeradius / freeradius | 2024-07-09 | 2026-10-15 |
| CVE-2023-45853 MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buf... |
critical | 9.8 | — | Zlib / zlib | 2023-10-14 | 2026-10-15 |
| CVE-2023-36660 The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption... |
critical | 9.8 | — | Nettle Project / nettle | 2023-06-25 | 2026-10-15 |
| CVE-2023-38408 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently t... |
critical | 9.8 | — | Openbsd / openssh | 2023-07-20 | 2026-10-15 |
| CVE-2026-105848 Payload is a free and open source headless content management system. |
critical | 9.6 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105857 Payload is a free and open source headless content management system. |
critical | 10.0 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105859 Payload is a free and open source headless content management system. |
critical | 9.8 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-105863 Payload is a free and open source headless content management system. |
critical | 9.4 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-84198 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84209 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-16340 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14991 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-15762 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-15 |
| CVE-2026-14269 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14502 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-82101 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.6 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-82110 IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated a... |
critical | 9.9 | — | Ibm / datastage on cloud pak for data | 2026-10-12 | 2026-10-14 |
| CVE-2026-96119 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obta... |
critical | 9.9 | — | Ibm / i | 2026-10-13 | 2026-10-14 |
| CVE-2026-85440 MOOS core-moos through 10.4.0 contains a pre-authentication heap overflow vulner... |
critical | 9.8 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85438 MOOS-IvP through 24.8.1 contains a buffer overflow vulnerability in StringToIvPF... |
critical | 9.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85437 MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP... |
critical | 9.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85435 MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE... |
critical | 9.1 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85434 MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity b... |
critical | 9.1 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2023-28531 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the inten... |
critical | 9.8 | — | Openbsd / openssh | 2023-03-17 | 2026-10-14 |
| CVE-2023-25139 sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds w... |
critical | 9.8 | — | Gnu / glibc | 2023-02-03 | 2026-10-14 |
| CVE-2023-23914 A cleartext transmission of sensitive information vulnerability exists in curl |
critical | 9.1 | — | Haxx / curl | 2023-02-23 | 2026-10-14 |
| CVE-2025-14191 A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. |
critical | 9.8 | — | Utt / 512w firmware | 2025-12-07 | 2026-10-14 |
| CVE-2025-14199 A flaw has been found in Verysync 微力同步 up to 2.21.3. |
critical | 9.8 | — | Verysync / verysync | 2025-12-07 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.