October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,591
Critical
3,297
High
7,976
Medium
7,646
Low
740
Severity not reported
4,932
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-63911 In the Linux kernel, the following vulnerability has been resolved:
xfrm: iptfs... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63918 In the Linux kernel, the following vulnerability has been resolved:
l2tp: use r... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63928 In the Linux kernel, the following vulnerability has been resolved:
USB: serial... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63930 In the Linux kernel, the following vulnerability has been resolved:
iio: buffer... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63934 In the Linux kernel, the following vulnerability has been resolved:
iio: gyro:... |
high | 7.1 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63943 In the Linux kernel, the following vulnerability has been resolved:
Input: xpad... |
high | 7.1 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63949 In the Linux kernel, the following vulnerability has been resolved:
auxdisplay:... |
high | 7.1 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-63950 In the Linux kernel, the following vulnerability has been resolved:
mm/rmap: in... |
high | 7.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-30 |
| CVE-2026-91217 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.6 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91219 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.6 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91228 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.1 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91237 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.5 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91238 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 7.1 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-91239 Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (compo... |
high | 8.8 | — | Oracle / soa suite | 2026-10-20 | 2026-10-30 |
| CVE-2026-114396 Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability... |
high | 7.1 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-114397 Trudesk through 1.2.11 contains a missing authentication vulnerability in debug... |
high | 7.4 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-30 |
| CVE-2026-101781 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.8 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-101771 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-96187 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-78410 A flaw was found in util-linux. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-30 |
| CVE-2026-78408 The nsenter --join-cgroup option opens the target cgroup.procs file as root and... |
high | 7.9 | — | — | 2026-09-02 | 2026-10-30 |
| CVE-2026-59229 The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a
hardcoded SU... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-61902 Apache bRPC versions before 1.18.0 do not consistently enforce the configured ma... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-62765 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-54426 Uncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54427 Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-56387 The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts d... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-58064 The Redis protocol implementation in Apache bRPC allowed inline command parsing... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-54425 Uncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-30 |
| CVE-2026-119578 MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119572 Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerab... |
high | 8.7 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-113057 Improper access control in ComputePressure in Google Chrome prior to 156.0.8078.... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-30 |
| CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to e... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-101770 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-30 |
| CVE-2026-113947 This issue was addressed with improved access restrictions. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-30 |
| CVE-2026-106634 Adobe Experience Manager is affected by an Improper Limitation of a Pathname to... |
high | 7.7 | — | Adobe / experience manager | 2026-10-13 | 2026-10-30 |
| CVE-2026-102590 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 7.7 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-103092 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
| CVE-2026-83699 Stack-based buffer overflow in Windows Client-Side Caching (CSC) Service allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-30 |
| CVE-2026-104328 IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-29 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.