October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85871 Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized a... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85872 Use after free in Windows Storage VSP Driver allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-114400 Trudesk through 1.2.11 contains a missing authentication vulnerability that allo... |
high | 7.5 | — | Trudesk Project / trudesk | 2026-10-21 | 2026-10-29 |
| CVE-2026-100105 A user with permission to edit contact points but not their protected fields can... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-88967 A user with query access to an Azure Monitor data source in Grafana can cause se... |
high | 7.7 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-83652 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-111417 A broken access control vulnerability exists in the Foxit official website’s HTM... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111418 A server-side request forgery (SSRF) vulnerability exists in the Foxit official... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-111419 A sensitive information exposure vulnerability exists on the Foxit official webs... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-118602 Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118603 Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118605 Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote... |
high | 8.0 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118606 Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Executi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118610 Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Exe... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118613 Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution V... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118614 Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118615 Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerabilit... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118616 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118617 Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Cod... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118618 Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118619 Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerabi... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111739 The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Securit... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115301 The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox th... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86794 The Community Events WordPress plugin before 1.6.0 does not have authorisation o... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-89216 The vTables WordPress plugin before 0.3 does not properly sanitise and escape a... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-86016 VNote is a note-taking platform. |
high | 8.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-115810 Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerabilit... |
high | 7.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-104875 Ente provides end-to-end encrypted cloud services and security tools. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-113387 The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116099 A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay... |
high | 8.8 | — | Fcs-ex / scp\ | 2026-10-26 | 2026-10-29 |
| CVE-2026-93521 A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server bef... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO pa... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118510 A type-handling flaw in the relationship query building of this MongoDB integrat... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-85874 Use after free in Windows Message Queuing Queue Manager allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85879 Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux... |
high | 7.0 | — | Microsoft / windows subsystem for linux | 2026-10-13 | 2026-10-29 |
| CVE-2026-85884 Missing authentication for critical function in Windows Health and Optimized Exp... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83845 Improper privilege management in Windows Internet (wininet.dll) allows an author... |
high | 8.4 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83848 Untrusted pointer dereference in Windows COM+ Event System Service allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83850 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.