October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,476
Critical
1,339
High
5,869
Medium
6,255
Low
648
Severity not reported
3,365
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110233 Rovr through 0.10.3 on Windows contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerabili... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temp... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110220 Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vu... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110211 iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability t... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110215 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110216 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110205 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-26 |
| CVE-2026-110206 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-16 |
| CVE-2026-110207 Wukong AICRM through 20260610 contains a missing authorization vulnerability tha... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110208 Wukong AICRM through 20260610 contains a missing authorization vulnerability in... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110111 Xen Orchestra before 6.9.0 contains an improper access control vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110112 Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110202 Roo Code through 3.54.0 contains a command approval bypass vulnerability in getC... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110203 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110204 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-109428 Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109429 Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerabili... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-109453 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108468 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108471 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108463 Improper resolution of path equivalence in Windows SmartScreen allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108464 Use after free in Software Protection Platform (SPP) allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108465 Use after free in Windows Update Delivery Optimization allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108467 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an auth... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108399 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 7.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108400 Integer overflow or wraparound in Microsoft Windows Codecs Library allows an una... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108457 Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108458 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108460 Use after free in Windows Message Queuing allows an unauthorized attacker to exe... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108461 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108136 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108396 Time-of-check time-of-use (toctou) race condition in Windows Modern Device Manag... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108398 Untrusted search path in .NET Framework allows an authorized attacker to bypass... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108130 Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclav... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108131 No cwe for this issue in Active Directory Federation Services (AD FS) allows an... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108132 Double free in Windows Kerberos allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108133 Release of invalid pointer or reference in Windows Modern Device Management (MDM... |
high | 7.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108134 Use after free in Windows Autopilot allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108135 Improper link resolution before file access ('link following') in Windows Backup... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.