October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
16,875
Critical
1,275
High
5,586
Medium
5,955
Low
624
Severity not reported
3,435
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1296), google (733), ibm (140), oracle (120), adobe (120), broadcom (61), apache (45), freerdp (42), linuxfoundation (41), dell (40)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110149 Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110136 Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110142 Use after free in FileSystem in Google Chrome prior to 155.0.8059.79 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-95695 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-90530 ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restrict... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-93895 IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-93909 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnera... |
critical | 9.1 | — | Ibm / websphere application server | 2026-10-13 | 2026-10-22 |
| CVE-2026-75994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-49950 Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulner... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-106619 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
critical | 9.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106620 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106621 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106622 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106624 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106612 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105899 ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vul... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-105903 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-90531 Adobe Experience Manager is affected by an Improper Restriction of XML External... |
critical | 9.6 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-90532 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | Adobe / experience manager | 2026-10-13 | 2026-10-29 |
| CVE-2026-83662 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-75732 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-63146 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-48383 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-48382 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-106626 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.1 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106629 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-106630 Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vuln... |
critical | 9.3 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-105895 Adobe Experience Manager is affected by an Improper Input Validation vulnerabili... |
critical | 9.9 | — | Adobe / experience manager | 2026-10-13 | 2026-10-26 |
| CVE-2026-104252 Vitess is a database clustering system for horizontal scaling of MySQL. |
critical | 9.8 | — | Linuxfoundation / vitess | 2026-10-13 | 2026-10-23 |
| CVE-2026-104585 Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-103848 Adobe Experience Manager is affected by an Improper Neutralization of Special El... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102238 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-97816 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97814 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97815 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.