October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69644 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69675 Out-of-bounds read in Windows Network File System allows an authorized attacker... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69635 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
medium | 6.6 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69640 Incorrect authorization in Windows Key Distribution Center allows an authorized... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69506 Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker... |
medium | 4.7 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-62687 Improper link resolution before file access ('link following') in Windows Backup... |
medium | 5.5 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-62879 Missing authentication for critical function in Windows SmartScreen allows an au... |
medium | 5.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-66822 Insertion of sensitive information into sent data in .NET allows an unauthorized... |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-54086 SLE API for Java is an implementation of CCSDS Space Link Extension Services. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-59116 Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allow... |
medium | 6.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-110239 Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability i... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110240 Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil... |
medium | 4.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110254 Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerabili... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110231 muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob t... |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110234 Elio through 1.13.0 contains an insecure temporary file vulnerability that allow... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110235 MP Manager through 1.1.0 contains a path traversal vulnerability that allows att... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110224 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110226 QloApps through 1.7.0 contains a broken access control vulnerability that allows... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110228 wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerabil... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110229 QloApps through 1.7.0 contains an improper access control vulnerability in Admin... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110230 XBackBone through 3.8.2 contains a missing authorization vulnerability that allo... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110219 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability th... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110221 QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in... |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110222 Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vul... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110212 Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability t... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110213 Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object refere... |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110217 Lenve vhr through commit 03abbd3 contains an information disclosure vulnerabilit... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110209 Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerab... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110210 Phase Console through 2.77.3 contains a missing authorization vulnerability that... |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-108462 Exposure of sensitive system information to an unauthorized control sphere in Wi... |
medium | 5.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108466 Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny ser... |
medium | 5.3 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-107606 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107607 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108127 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108128 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-108129 Out-of-bounds read in DNS Server allows an authorized attacker to disclose infor... |
medium | 6.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-105731 Use of uninitialized resource in Microsoft Graphics Component allows an authoriz... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-107605 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Auth... |
medium | 6.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105720 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
medium | 4.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105726 Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclo... |
medium | 5.5 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.