October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,474
Critical
3,283
High
7,907
Medium
7,596
Low
741
Severity not reported
4,947
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2021-20232 A flaw was found in gnutls. |
critical | 9.8 | — | Gnu / gnutls | 2021-03-12 | 2026-10-14 |
| CVE-2021-3520 There's a flaw in lz4. |
critical | 9.8 | — | Lz4 Project / lz4 | 2021-06-02 | 2026-10-14 |
| CVE-2021-3177 Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callpro... |
critical | 9.8 | — | Python / python | 2021-01-19 | 2026-10-14 |
| CVE-2020-35527 In SQLite 3.31.1, there is an out of bounds access problem through ALTER TABLE f... |
critical | 9.8 | — | Sqlite / sqlite | 2022-09-01 | 2026-10-14 |
| CVE-2020-15801 In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ign... |
critical | 9.8 | — | Python / python | 2020-07-17 | 2026-10-14 |
| CVE-2020-11656 In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, a... |
critical | 9.8 | — | Sqlite / sqlite | 2020-04-09 | 2026-10-14 |
| CVE-2019-1010022 GNU Libc current is affected by: Mitigation bypass. |
critical | 9.8 | — | Gnu / glibc | 2019-07-15 | 2026-10-14 |
| CVE-2025-58443 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
critical | 9.1 | — | Fogproject / fogproject | 2025-09-06 | 2026-10-14 |
| CVE-2019-20367 nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison fo... |
critical | 9.1 | — | Freedesktop / libbsd | 2020-01-08 | 2026-10-14 |
| CVE-2019-19317 lookupName in resolve.c in SQLite 3.30.1 omits bits from the colUsed bitmask in... |
critical | 9.8 | — | Sqlite / sqlite | 2019-12-05 | 2026-10-14 |
| CVE-2019-19646 pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAG... |
critical | 9.8 | — | Sqlite / sqlite | 2019-12-09 | 2026-10-14 |
| CVE-2019-9948 urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes... |
critical | 9.1 | — | Python / python | 2019-03-23 | 2026-10-14 |
| CVE-2019-9636 Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handl... |
critical | 9.8 | — | Python / python | 2019-03-08 | 2026-10-14 |
| CVE-2019-9169 In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in pos... |
critical | 9.8 | — | Gnu / glibc | 2019-02-26 | 2026-10-14 |
| CVE-2019-8457 SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound re... |
critical | 9.8 | — | Sqlite / sqlite | 2019-05-30 | 2026-10-14 |
| CVE-2019-5481 Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3. |
critical | 9.8 | — | Haxx / curl | 2019-09-16 | 2026-10-14 |
| CVE-2019-5482 Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. |
critical | 9.8 | — | Haxx / curl | 2019-09-16 | 2026-10-14 |
| CVE-2019-3862 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH... |
critical | 9.1 | — | Libssh2 / libssh2 | 2019-03-21 | 2026-10-14 |
| CVE-2019-3859 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the _libssh... |
critical | 9.1 | — | Libssh2 / libssh2 | 2019-03-21 | 2026-10-14 |
| CVE-2019-3858 An out of bounds read flaw was discovered in libssh2 before 1.8.1 when a special... |
critical | 9.1 | — | Libssh2 / libssh2 | 2019-03-21 | 2026-10-14 |
| CVE-2019-3860 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SFT... |
critical | 9.1 | — | Libssh2 / libssh2 | 2019-03-25 | 2026-10-14 |
| CVE-2019-3861 An out of bounds read flaw was discovered in libssh2 before 1.8.1 in the way SSH... |
critical | 9.1 | — | Libssh2 / libssh2 | 2019-03-25 | 2026-10-14 |
| CVE-2019-18224 idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based bu... |
critical | 9.8 | — | Gnu / libidn2 | 2019-10-21 | 2026-10-14 |
| CVE-2019-12900 BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write... |
critical | 9.8 | — | Bzip / bzip2 | 2019-06-19 | 2026-10-14 |
| CVE-2019-10160 A security regression of CVE-2019-9636 was discovered in python since commit d53... |
critical | 9.8 | — | Python / python | 2019-06-07 | 2026-10-14 |
| CVE-2018-18928 International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflo... |
critical | 9.8 | — | Icu-project / international components for unicode | 2018-11-04 | 2026-10-14 |
| CVE-2017-7375 A flaw in libxml2 allows remote XML entity inclusion with default parser flags (... |
critical | 9.8 | — | Xmlsoft / libxml2 | 2018-02-19 | 2026-10-14 |
| CVE-2017-7376 Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by... |
critical | 9.8 | — | Xmlsoft / libxml2 | 2018-02-19 | 2026-10-14 |
| CVE-2017-16931 parser.c in libxml2 before 2.9.5 mishandles parameter-entity references because... |
critical | 9.8 | — | Xmlsoft / libxml2 | 2017-11-23 | 2026-10-14 |
| CVE-2016-4658 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before... |
critical | 9.8 | — | Apple / iphone os | 2016-09-25 | 2026-10-14 |
| CVE-2026-70188 Inconsistent interpretation of http requests ('http request/response smuggling')... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108540 A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. |
critical | 9.9 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-107699 ppt2png through 0.0.6 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-104075 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-70279 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-92701 Cocos AI is a confidential computing system for AI. |
critical | 9.1 | — | — | 2026-09-18 | 2026-10-13 |
| CVE-2026-92702 Cocos AI is a confidential computing system for AI. |
critical | 9.1 | — | — | 2026-09-18 | 2026-10-13 |
| CVE-2026-83780 Use after free in Windows CCFFilter Driver allows an unauthorized attacker to ex... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-54454 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100758 Sandbox escape in the DOM: Navigation component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.