October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,209
Critical
1,207
High
5,399
Medium
5,736
Low
600
Severity not reported
3,267
In CISA KEV
17
Most affected vendors (by CPE data where available): microsoft (1078), google (711), ibm (140), oracle (117), adobe (110), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stac... |
medium | 4.6 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.