October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83566 Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. |
high | 8.8 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-28 |
| CVE-2026-96644 Pillow is a Python imaging library. |
high | 8.1 | — | Python / pillow | 2026-10-21 | 2026-10-28 |
| CVE-2026-91342 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91346 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91347 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Ser... |
high | 8.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91348 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utilit... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91321 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91325 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91340 Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91316 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-61726 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerabili... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-28 |
| CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vuln... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI lo... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-114440 A vulnerability was identified in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114138 Django REST framework is a toolkit for building Web APIs. |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2018-25438 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path trave... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-88152 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability |
high | 8.8 | Listed | Apple / Multiple Products | 2025-11-05 | 2026-10-28 |
| CVE-2023-22839 On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before... |
high | 7.5 | — | F5 / big-ip domain name system | 2023-02-01 | 2026-10-28 |
| CVE-2023-0698 Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a r... |
high | 8.8 | — | Google / chrome | 2023-02-07 | 2026-10-28 |
| CVE-2023-0251 Delta Electronics DIAScreen versions 1.2.1.23 and prior are vulnerable to a buff... |
high | 7.8 | — | Deltaww / diascreen | 2023-02-08 | 2026-10-28 |
| CVE-2023-23783 A use of externally-controlled format string in Fortinet FortiWeb version 7.0.0... |
high | 7.8 | — | Fortinet / fortiweb | 2023-02-16 | 2026-10-28 |
| CVE-2023-22234 Adobe Premiere Rush version 2.6 (and earlier) is affected by a Stack-based Buffe... |
high | 7.8 | — | Adobe / premiere rush | 2023-02-17 | 2026-10-28 |
| CVE-2023-22789 Multiple authenticated command injection vulnerabilities exist in the Aruba Inst... |
high | 8.8 | — | Arubanetworks / arubaos | 2023-05-08 | 2026-10-28 |
| CVE-2023-29154 SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions pr... |
high | 7.2 | — | Contec / conprosys hmi system | 2023-06-01 | 2026-10-28 |
| CVE-2023-34119 Insecure temporary file in the installer for Zoom Rooms for Windows before versi... |
high | 7.8 | — | Zoom / rooms | 2023-07-11 | 2026-10-28 |
| CVE-2023-46718 A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.1 an... |
high | 7.8 | — | Fortinet / fortios | 2025-10-14 | 2026-10-28 |
| CVE-2023-53692 In the Linux kernel, the following vulnerability has been resolved:
ext4: fix u... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53695 In the Linux kernel, the following vulnerability has been resolved:
udf: Detect... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53698 In the Linux kernel, the following vulnerability has been resolved:
xsk: fix re... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53705 In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix o... |
high | 8.2 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53707 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53711 In the Linux kernel, the following vulnerability has been resolved:
NFS: Fix a... |
high | 8.2 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53713 In the Linux kernel, the following vulnerability has been resolved:
arm64: sme:... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53718 In the Linux kernel, the following vulnerability has been resolved:
ring-buffer... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53726 In the Linux kernel, the following vulnerability has been resolved:
arm64: csum... |
high | 7.1 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-53729 In the Linux kernel, the following vulnerability has been resolved:
soc: qcom:... |
high | 7.8 | — | — | 2025-10-22 | 2026-10-28 |
| CVE-2023-49440 AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." |
high | 8.8 | — | — | 2025-10-27 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.