October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113907 A buffer overflow issue was addressed with improved memory handling. |
medium | 6.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-113908 A privacy issue was addressed by removing sensitive data. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112708 A race condition was addressed with improved locking. |
medium | 5.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-113896 A race condition was addressed with additional validation. |
medium | 4.7 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112701 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112706 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112685 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112675 This issue was addressed with additional entitlement checks. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112678 A permissions issue was addressed with additional restrictions. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112658 This issue was addressed with improved input validation. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112646 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112634 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112629 An out-of-bounds read was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112633 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112614 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112616 An authorization issue was addressed with improved access control. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112617 An information disclosure issue was addressed with improved logic. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112618 An access issue was addressed with improved access restrictions. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112609 This issue was addressed with improved checks. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112556 A race condition was addressed with additional validation. |
medium | 4.8 | — | Apple / macos | 2026-10-26 | 2026-10-30 |
| CVE-2026-112559 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112544 An out-of-bounds write issue was addressed with improved bounds checking. |
medium | 6.5 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112547 A type confusion issue was addressed with improved checks. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112533 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112506 A permissions issue was addressed with improved validation. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112471 A buffer overflow was addressed with improved bounds checking. |
medium | 4.3 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112455 An authorization issue was addressed with improved state management. |
medium | 5.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-112415 An out-of-bounds write was addressed with improved input validation. |
medium | 6.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-70382 Some externally supplied values stored by the device may be rendered in the web... |
medium | 4.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-70380 A denial-of-service vulnerability has been identified in the Miracast over Infra... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-70381 An access-control vulnerability has been identified in the web server configurat... |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-... |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-115927 Tornado is a Python web framework and asynchronous networking library. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116467 A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. |
medium | 5.3 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116471 A security flaw has been discovered in BKWLD Decoy up to 5.11.1. |
medium | 4.3 | — | — | 2026-10-26 | 2026-10-31 |
| CVE-2026-116476 A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116631 A malicious web page could open a tel link in a window that was showing a differ... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116632 A malicious web page could insert arbitrary text into the FaceTime call prompt s... |
medium | 5.4 | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.