October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107618 `POST /{owner}/{repo}/topics` was registered without the sign-in middleware that... |
high | 8.1 | — | — | 2026-10-18 | 2026-10-29 |
| CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110673 Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encodi... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-29 |
| CVE-2026-91798 A local privilege escalation vulnerability exists in the update daemon of Foxit... |
high | 8.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-91794 An out-of-bounds write vulnerability exists in the PDF rendering process of Foxi... |
high | 7.8 | — | Foxit / pdf editor | 2026-09-23 | 2026-10-29 |
| CVE-2026-83784 Absolute path traversal in Windows Encrypting File System (EFS) allows an author... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-101421 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-29 |
| CVE-2026-101772 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 8.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-29 |
| CVE-2026-101773 Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (compon... |
high | 7.1 | — | Oracle / mysql cluster | 2026-10-20 | 2026-10-29 |
| CVE-2026-84294 Improper limitation of pathname in the Ad Hoc Transfer component of Progress Sof... |
high | 7.7 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85749 MailWatch for MailScanner is a web-based front-end to MailScanner. |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-119049 FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows... |
high | 7.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability |
high | 8.8 | Listed | Microsoft / Windows | 2026-10-13 | 2026-10-29 |
| CVE-2026-96202 Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', be... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118633 A path traversal vulnerability allows a remote unauthenticated attacker to execu... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118905 Node Version Manager (nvm) is a POSIX-compliant shell function for managing mult... |
high | 7.0 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that all... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61572 AVideo is a video-sharing Platform. |
high | 8.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-61569 AVideo is a video-sharing Platform. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-23705 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-116048 A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116067 Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSh... |
high | 8.2 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-115970 A vulnerability has been found in Travisun Opptrix 0.4.0. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115973 A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. |
high | 7.3 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-115999 A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116006 A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-83785 Use after free in Windows COM+ Event System Service allows an authorized attacke... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-6647 In deployments of WSO2 Identity Server configured with a case-insensitive user s... |
high | 7.4 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-78674 The BPMN System REST APIs do not sufficiently validate input parameters, allowin... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-33923 A signature verification vulnerability was discovered in the update installation... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-33924 Two OS command injection vulnerabilities were discovered in the update installat... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86949 This issue was addressed by enforcing library validation on the affected binarie... |
high | 8.8 | — | Apple / xcode | 2026-10-20 | 2026-10-29 |
| CVE-2026-103665 The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation... |
high | 7.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-85867 Heap-based buffer overflow in Windows Remote Access Connection Manager allows an... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85868 Use after free in Windows Common Log File System Driver allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85869 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85870 Heap-based buffer overflow in Windows Common Log File System Driver allows an au... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.