October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,573
Critical
3,295
High
7,972
Medium
7,638
Low
740
Severity not reported
4,928
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86937 A logic issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86939 A permissions issue was addressed with additional restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86941 A file quarantine bypass was addressed with additional checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86942 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86943 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86945 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86946 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86958 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86964 A null pointer dereference was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86966 This issue was addressed with improved handling of symlinks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86968 An access issue was addressed with improved access control. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86969 An out-of-bounds write was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86970 An out-of-bounds read was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86972 A buffer overflow was addressed with improved size validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86973 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86974 A type confusion issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86978 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86984 A file access issue existed with certain home folder files. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86985 This issue was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86986 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86988 The issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86989 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86990 An access issue was addressed with improved access restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86991 A buffer overflow was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-86992 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113713 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113718 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113723 virtualenv is a tool for creating isolated virtual python environments. |
not reported | — | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-18756 HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulner... |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-65609 nnn is vulnerable to Out-of-Bound write vulnerability. |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-65610 nnn stores homelen variable as uchar_t, which can only represent values in the r... |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-65611 nnn does not sanitize the path variable. |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-65612 nnn does not sanitize the filename variable. |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-18526 HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scrip... |
not reported | — | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-97028 Rejected reason: Maintainers determined it is not a vulnerability. |
not reported | — | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-114583 tarfile.tar_filter could be bypassed using crafted link entries, including symli... |
not reported | — | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2026-115557 Python has added a denylist for known compromised certificates to the "ssl" modu... |
not reported | — | — | — | 2026-10-24 | 2026-10-27 |
| CVE-2026-66042 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-66043 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-66044 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-26 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.