October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,479
Critical
1,340
High
5,869
Medium
6,256
Low
648
Severity not reported
3,366
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109950 FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerabilit... |
medium | 4.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109951 FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in D... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109952 The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109941 FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109942 FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_pack... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109943 FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109944 FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardRelea... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109945 FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smar... |
medium | 5.9 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109946 FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109947 FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation v... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-21 |
| CVE-2026-109678 FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109679 FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_han... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109680 FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_int... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-20 |
| CVE-2026-109938 Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stac... |
medium | 4.6 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109677 FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerabil... |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109409 A flaw has been found in HBAI-Ltd Toonflow-app up to 1.1.8. |
medium | 5.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-67456 NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based... |
medium | 4.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-65131 NVIDIA NVSentinel for Linux contains a vulnerability in the platform-connectors... |
medium | 6.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109781 Denial-of-service in the Printing: Output component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109833 A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. |
medium | 5.9 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109976 A flaw was found in the clevis PKCS#11 pin. |
medium | 4.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-109773 Denial-of-service in the Sync component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109775 Denial-of-service in the WebRTC component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109776 Race condition in the XPCOM component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109777 Information disclosure in the Storage: IndexedDB component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109779 Race condition in the Networking: DNS component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109763 Mitigation bypass in the File Handling component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-109764 Mitigation bypass in the Enterprise Policies component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component. |
medium | 4.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109767 Information disclosure in the Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109768 Denial-of-service in the Site Reports component. |
medium | 6.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109769 Information disclosure in the Networking: Cache component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109770 Spoofing issue in the DOM: Web Serial component. |
medium | 6.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109771 Information disclosure in the WebRTC: Networking component. |
medium | 4.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109752 Use-after-free in the DOM: Workers component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component. |
medium | 5.4 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.