October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42692 Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61988 Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61995 Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116868 Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118076 Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118081 Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116177 vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vul... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116189 rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in sta... |
high | 7.5 | — | Rclone / rclone | 2026-10-25 | 2026-10-29 |
| CVE-2026-116050 A vulnerability has been found in krupalshah Employee Recruitment System up to 9... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-108494 Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107042 Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 a... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96108 Use after free in Desktop Window Manager allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-95943 Double free in Connected Devices Platform Service (Cdpsvc) allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83741 Use after free in Internet Explorer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83740 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83739 Use after free in Windows Bluetooth Service allows an unauthorized attacker to e... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83738 Use after free in Windows Ancillary Function Driver for WinSock allows an author... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83725 Heap-based buffer overflow in Microsoft Windows Search Component allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83513 Use after free in Windows Universal Disk Format File System Driver (UDFS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83514 Heap-based buffer overflow in Windows Partition Management Driver allows an auth... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83735 Release of invalid pointer or reference in Windows Kernel allows an authorized a... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83516 Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS)... |
high | 7.5 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83580 Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83583 Improper access control in Windows Geotag Broker allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83586 Weak authentication in Windows Resilient File System (ReFS) Deduplication Servic... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83587 Untrusted pointer dereference in Windows Core Messaging allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83641 Heap-based buffer overflow in Windows Media allows an authorized attacker to ele... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83692 Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85943 Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transpor... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83700 Use after free in Windows Now Playing Session Manager allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83701 Use after free in Windows Now Playing Session Manager allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85864 Improper privilege management in Python allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83702 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85881 Stack-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 8.0 | — | Microsoft / 365 copilot | 2026-10-13 | 2026-10-29 |
| CVE-2026-83687 Use after free in Windows Connected User Experiences and Telemetry allows an aut... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83689 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83715 Missing authentication for critical function in Windows Error Reporting allows a... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83716 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83717 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83718 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.