October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-118080 Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116867 Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 version... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114621 baserCMS is a website development framework. |
high | 8.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string ke... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-108088 ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vu... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-83918 Integer overflow or wraparound in Windows Kernel allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83919 Heap-based buffer overflow in Microsoft Internet Messaging API allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83920 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83921 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83922 Use after free in Windows Direct Composition allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83569 Heap-based buffer overflow in HID Parser Library allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70110 Stack-based buffer overflow in Microsoft PostScript Printer Driver allows an una... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-70109 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unau... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83759 Improper control of generation of code ('code injection') in Windows Encrypting... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85318 Heap-based buffer overflow in Servicing Stack Updates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83762 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83763 Access of resource using incompatible type ('type confusion') in Windows Input S... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85319 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83518 Heap-based buffer overflow in RPC Runtime allows an authorized attacker to eleva... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83515 Use of uninitialized resource in RPC Runtime allows an unauthorized attacker to... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-16453 Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8... |
high | 7.1 | — | Mattermost / mattermost server | 2026-10-16 | 2026-10-29 |
| CVE-2026-85321 Allocation of resources without limits or throttling in Active Directory Federat... |
high | 7.5 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83564 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85828 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83767 Stack-based buffer overflow in Windows Installer allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83769 Use after free in OpenSSH for Windows allows an authorized attacker to elevate p... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-46300 In the Linux kernel, the following vulnerability has been resolved:
net: skbuff... |
high | 7.8 | Listed | Linux / linux kernel | 2026-05-23 | 2026-10-29 |
| CVE-2026-91213 Vulnerability in the Oracle Business Process Management Suite product of Oracle... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-84387 A improper neutralization of special elements used in a command ('command inject... |
high | 7.2 | — | — | 2026-09-08 | 2026-10-29 |
| CVE-2026-39736 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116399 Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect insta... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116174 vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerabili... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-29 |
| CVE-2026-116062 A security flaw has been discovered in SourceCodester Performance Indicator Syst... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116098 A vulnerability was detected in SteelRaven7 Ravenfield 25407073. |
high | 7.8 | — | Steelraven7 / ravenfield | 2026-10-26 | 2026-10-29 |
| CVE-2026-116014 open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStr... |
high | 8.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecti... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffer... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking chan... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retai... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.