October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,707
Critical
3,235
High
7,704
Medium
7,359
Low
705
Severity not reported
4,704
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-106077 A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administ... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-106078 A vulnerability allowing an unauthenticated attacker to bypass REST API authenti... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-107671 A vulnerability allowing an attacker with valid Administrator credentials to byp... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108140 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108141 A vulnerability allowing an authenticated user with the Restore Operator role, w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-108142 A vulnerability allowing an unauthenticated attacker to bypass authorization on... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-14571 A Blind SQL Injection vulnerability in Futurum Software’s management software, c... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112197 Vulnerability due to a lack of authentication in critical functions of the NoviG... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-112198 XML External Entity (XXE) injection vulnerability in the SAFT import feature of... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118174 When a message containing an OpenPGP key attachment was displayed, Thunderbird a... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunder... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118177 When looking for calendars in a directory on a server, during account setup or w... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118178 A remote RSS feed could use the itunes:new-feed-url or newLocation element to pe... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118179 Clicking a news: or snews: link that referenced a message-ID made Thunderbird co... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-118180 When logging in to a Matrix account, Thunderbird used the homeserver address pro... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-103594 A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configura... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-104381 A missing authentication vulnerability in Fireware OS's FireCluster state synchr... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-111107 A NULL pointer dereference vulnerability in WatchGuard Fireware OS’s management... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112709 A heap-based buffer overflow vulnerability in the Fireware OS authentication ser... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-112710 A heap-based buffer overflow vulnerability exists in the Fireware OS authenticat... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-113881 A stack-based buffer overflow vulnerability in Fireware OS's VPN Network Access... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-115495 Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-82332 An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint m... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-90442 A stack-based buffer overflow vulnerability in the Fireware OS certd process all... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-90464 An external control of file path vulnerability in a WatchGuard Fireware OS firew... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-93434 An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-93866 An integer overflow vulnerability in the WebSocket connection handling used by W... |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57192 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57199 Asterisk is an open source private branch exchange and telephony toolkit. |
not reported | — | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-114111 sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vu... |
not reported | — | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-113654 ApostropheCMS is an open-source Node.js content management system, and sanitize-... |
not reported | — | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-13833 A vulnerability exists in SecureConnector for Windows when the “Additional Appli... |
not reported | — | — | — | 2026-10-26 | 2026-10-28 |
| CVE-2026-93515 A use-after-free in present_clear_window_notifies() in the X.org X Server before... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99215 In the Linux kernel, the following vulnerability has been resolved:
power: supp... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99207 In the Linux kernel, the following vulnerability has been resolved:
scsi: targe... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99208 In the Linux kernel, the following vulnerability has been resolved:
drm/xe/oa:... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99209 In the Linux kernel, the following vulnerability has been resolved:
drm/xe: ski... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99210 In the Linux kernel, the following vulnerability has been resolved:
accel/rocke... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-99199 In the Linux kernel, the following vulnerability has been resolved:
net: hisili... |
not reported | — | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.