October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,571
Critical
3,293
High
7,942
Medium
7,637
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-71328 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2022 | 2026-09-08 | 2026-10-30 |
| CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-23 | 2026-10-30 |
| CVE-2026-69806 Exposure of sensitive information to an unauthorized actor in .NET allows an aut... |
high | 7.0 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-69767 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69610 Buffer over-read in Windows Win32K allows an authorized attacker to elevate priv... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69576 Use after free in Graphic Fonts allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69556 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69522 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | — | 2026-09-08 | 2026-10-30 |
| CVE-2026-69499 Integer overflow or wraparound in Windows Imaging Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69439 Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-63182 LightSAML implements SAML 2.0 data model classes, XML serialization and deserial... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unautho... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-118938 In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-16760 In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-107161 A heap-based buffer overflow flaw was found in Cyrus SASL. |
high | 7.5 | — | — | 2026-10-07 | 2026-10-30 |
| CVE-2026-62990 Shopper is a Headless e-commerce Admin Panel. |
high | 8.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62966 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62967 ZTNET is a ZeroTier web UI for private controllers with multiuser and organizati... |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. |
high | 8.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62958 libriscv is a RISC-V sandbox and emulator. |
high | 7.9 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62297 ag-psd is a JavaScript library for reading and writing Photoshop Document files. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-62848 Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. |
high | 7.3 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-57201 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-57200 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-58412 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-40573 NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. |
high | 8.6 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-88083 Stack-based buffer overflow in SQL Server allows an unauthorized attacker to exe... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88088 Integer overflow or wraparound in SQL Server allows an authorized attacker to el... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88081 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-88082 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-87346 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86948 This issue was addressed by enforcing library validation on the affected binarie... |
high | 8.8 | — | Apple / xcode | 2026-10-20 | 2026-10-30 |
| CVE-2026-85919 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-81627 A flaw was found in QEMU. |
high | 8.2 | — | — | 2026-09-18 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.