October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83923 Relative path traversal in OpenSSH for Windows allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83846 Use after free in Connected Devices Platform Service (Cdpsvc) allows an authoriz... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83847 Heap-based buffer overflow in Microsoft Account allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83863 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83868 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83877 Integer overflow or wraparound in HID Parser Library allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83901 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83902 Heap-based buffer overflow in Windows Direct Composition allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83903 Heap-based buffer overflow in Windows Direct Composition allows an authorized at... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83644 Use after free in Windows Audio Service allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83908 Release of invalid pointer or reference in RPC Runtime allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83643 Stack-based buffer overflow in Windows Error Reporting allows an unauthorized at... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83911 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83912 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83913 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83914 Use after free in Microsoft XML allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83645 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83915 Use after free in Windows Diagnostic Policy Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83916 Double free in Windows Error Reporting allows an authorized attacker to execute... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83917 Use after free in Windows ALPC allows an authorized attacker to elevate privileg... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-93446 Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connection... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-87743 A flaw was found in Quarkus HTTP security. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-29 |
| CVE-2026-88041 Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-86467 Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-80353 Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-61993 Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-57845 Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnera... |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-54866 Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-54455 OpenCATS is an open-source applicant tracking system and recruitment CRM for sta... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-34485 Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability w... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authe... |
high | 7.4 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119129 ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authoriz... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118804 Bricks Builder 2.4.3 and before contains a broken access control vulnerability t... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119052 llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in th... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83647 Out-of-bounds read in Active Directory Domain Services allows an unauthorized at... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-118694 python-markdown2 through 2.5.5 contains a denial of service vulnerability that a... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118755 Volmarg Personal Management System through 2.1.0 contains an OS command injectio... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118660 Happy DOM is a JavaScript implementation of a web browser without its graphical... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118075 Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.