October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107037 Insecure permissions in the NotificationHelper component of NoNonsense Notes ver... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-105208 ZITADEL 4.x before 4.17.3 and 3.x through 3.4.15 protects IdP intent tokens with... |
high | 7.7 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105210 ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authenticatio... |
high | 8.2 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-105212 ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypas... |
high | 7.5 | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2026-104085 odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerabi... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-102486 Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-104591 libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_paylo... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-104596 libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplem... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-29 |
| CVE-2026-102483 Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to te... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-29 |
| CVE-2026-100709 Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (p... |
high | 7.5 | — | — | 2026-09-26 | 2026-10-29 |
| CVE-2025-71398 SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allow... |
high | 7.6 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2025-34509 Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 1... |
high | 7.5 | — | Sitecore / experience commerce | 2025-06-17 | 2026-10-29 |
| CVE-2025-34506 WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution... |
high | 8.8 | — | Wbce / wbce cms | 2025-12-11 | 2026-10-29 |
| CVE-2025-71392 SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to prop... |
high | 8.0 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-29 |
| CVE-2024-58366 SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Ex... |
high | 8.8 | — | Delskayn / rquickjs | 2026-07-18 | 2026-10-29 |
| CVE-2025-15620 HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.0... |
high | 8.6 | — | Belden / hios switch | 2026-04-02 | 2026-10-29 |
| CVE-2023-53937 Hubstaff 1.6.13 and 1.6.14 contain a DLL search order hijacking vulnerability th... |
high | 7.8 | — | Hubstaff / hubstaff | 2025-12-18 | 2026-10-29 |
| CVE-2023-53982 PMB 7.4.6 contains a SQL injection vulnerability in the id parameter of the stor... |
high | 7.5 | — | Sigb / pmb | 2025-12-23 | 2026-10-29 |
| CVE-2017-20238 Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and... |
high | 7.1 | — | — | 2026-04-03 | 2026-10-29 |
| CVE-2018-25308 BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion... |
high | 8.8 | — | — | 2026-04-29 | 2026-10-29 |
| CVE-2017-20243 WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQ... |
high | 8.2 | — | — | 2026-06-09 | 2026-10-29 |
| CVE-2016-20084 WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escala... |
high | 7.2 | — | — | 2026-06-15 | 2026-10-29 |
| CVE-2026-69966 Integer overflow or wraparound in Microsoft Streaming Service allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70198 Use after free in Windows Push Notifications allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83666 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83670 Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83674 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83688 Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83694 Out-of-bounds read in Windows Volume Manager Extension Driver allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-96512 A flaw was found in sudo. |
high | 7.8 | — | — | 2026-09-23 | 2026-10-29 |
| CVE-2026-72764 n8n's JavaScript task runner shared a single module cache across all users' Code... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72766 n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a type... |
high | 7.5 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72767 n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remot... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72768 n8n versions before 2.32.1 contain a server-side request forgery protection bypa... |
high | 8.3 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72769 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerabi... |
high | 8.1 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65598 n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the... |
high | 7.5 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-72750 n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability i... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-72762 n8n versions before 1.123.67, 2.31.5, and 2.32.1 contain an arbitrary file write... |
high | 8.8 | — | N8n / n8n | 2026-08-11 | 2026-10-29 |
| CVE-2026-65595 n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued th... |
high | 8.8 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
| CVE-2026-65596 n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Reque... |
high | 8.1 | — | N8n / n8n | 2026-07-22 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.