October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,417
Critical
1,331
High
5,820
Medium
6,228
Low
648
Severity not reported
3,390
In CISA KEV
20
Most affected vendors (by CPE data where available): microsoft (1307), google (756), oracle (156), ibm (140), adobe (138), broadcom (61), langflow (57), apache (45), freerdp (42), linuxfoundation (41)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110914 Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a r... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110915 Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-111357 Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked brok... |
high | 7.0 | Listed | Ivanti / connect secure | 2026-10-15 | 2026-10-31 |
| CVE-2026-109468 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-108445 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108446 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108447 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108448 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108449 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108451 Numeric truncation error in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-15 | 2026-10-19 |
| CVE-2026-108437 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108439 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108440 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108441 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108442 Use after free in Microsoft Office Word allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108443 Off-by-one error in Microsoft Office Word allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108444 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108428 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108429 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108430 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108431 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108432 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108433 Reliance on untrusted inputs in a security decision in Microsoft Office Word all... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108426 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108427 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-105035 The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) us... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105036 EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105040 The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in a... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105033 The EnergizeLab AI Station (RK3562) firmware image ships with default root crede... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-105034 The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary rob... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106700 ELADMIN v2.7 and earlier contains an improper access control vulnerability in th... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-106708 XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF)... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-97370 Junrar is an open source Java RAR archive library. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-87029 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-87018 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-55872 GYM One is open-source gym management software for fitness centers, personal tra... |
high | 8.7 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55239 Tianji is an open source analytics, uptime monitoring, and server status platfor... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-55587 AliasVault is a privacy-first password manager with built-in email aliasing. |
high | 8.1 | — | — | 2026-10-15 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.