October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,209
Critical
3,102
High
7,090
Medium
6,615
Low
674
Severity not reported
4,728
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-17068 IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version... |
low | 3.3 | — | Ibm / i | 2026-10-16 | 2026-10-23 |
| CVE-2026-4921 IBM Guardium Data Protection 12.2 could allow an administrative user to obtain s... |
low | 2.7 | — | Ibm / guardium data protection | 2026-09-23 | 2026-10-20 |
| CVE-2026-18173 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
low | 3.7 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.