October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,480
Critical
1,341
High
5,898
Medium
6,281
Low
651
Severity not reported
3,309
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1320), google (757), oracle (178), ibm (140), adobe (138), broadcom (61), apple (59), langflow (57), apache (47), freerdp (42)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112609 This issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-112556 A race condition was addressed with additional validation. |
medium | 4.8 | — | Apple / macos | 2026-10-26 | 2026-10-30 |
| CVE-2026-112559 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-112544 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112547 A type confusion issue was addressed with improved checks. |
medium | 5.5 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-112533 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-10-26 | 2026-11-02 |
| CVE-2026-112471 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112415 An out-of-bounds write was addressed with improved input validation. |
medium | 6.5 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-86979 A privacy issue was addressed with improved checks. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86981 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86940 This issue was addressed by removing the vulnerable code. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86915 A race condition was addressed with improved locking. |
medium | 4.7 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86928 A path handling issue was addressed with improved validation. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86932 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86935 This issue was addressed by removing additional entitlements. |
medium | 5.5 | — | Apple / macos | 2026-10-20 | 2026-10-30 |
| CVE-2026-86875 An input validation issue was addressed with improved input validation. |
medium | 4.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-84605 An authorization issue was addressed with improved state management. |
low | 3.3 | — | Apple / ipados | 2026-10-26 | 2026-11-02 |
| CVE-2026-86933 A permissions issue was addressed with additional sandbox restrictions. |
low | 3.3 | — | Apple / macos | 2026-10-20 | 2026-10-29 |
| CVE-2026-86874 An out-of-bounds read was addressed with improved input validation. |
low | 3.3 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.