October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,140
Critical
1,303
High
5,710
Medium
6,092
Low
636
Severity not reported
3,399
In CISA KEV
19
Most affected vendors (by CPE data where available): microsoft (1303), google (745), oracle (156), ibm (140), adobe (128), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112497 This issue was addressed with improved permissions checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112483 A path handling issue was addressed with improved validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112485 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112486 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112487 A path handling issue was addressed with improved validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112488 A buffer overflow issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112477 A race condition was addressed with improved locking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112478 An out-of-bounds read issue was addressed by removing the vulnerable code. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112479 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112480 A permissions issue was addressed with additional restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112481 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112482 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112469 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112470 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112473 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112474 A use-after-free issue was addressed with improved memory management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112475 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112476 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112461 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112462 A permissions issue was addressed with additional restrictions. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112464 An out-of-bounds write issue was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112466 An out-of-bounds read was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112467 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112468 An out-of-bounds write issue was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112453 A path handling issue was addressed with improved validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112454 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112456 An out-of-bounds write issue was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112459 A race condition was addressed with improved state handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112442 A race condition was addressed with additional validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112443 The issue was addressed with improved memory handling. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112444 This issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112446 This issue was addressed with additional entitlement checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112447 An authorization issue was addressed with improved state management. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112449 An integer overflow was addressed with improved input validation. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112451 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112432 A logging issue was addressed with improved data redaction. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112434 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112437 A logic issue was addressed with improved checks. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112441 This issue was addressed by removing the vulnerable code. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-112424 An out-of-bounds read was addressed with improved bounds checking. |
not reported | — | — | — | 2026-10-26 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.