October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-91338 Vulnerability in the iSupport product of Oracle E-Business Suite (component: Int... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91326 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91327 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91328 Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-114259 A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114262 A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-111577 The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111021 The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105972 The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise an... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-102834 JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia librarie... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2017-20287 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-28 |
| CVE-2026-78459 Heap-based buffer overflow in Windows Internet Information Services allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83511 Weak authentication in Active Directory Federation Services (AD FS) allows an un... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63952 In the Linux kernel, the following vulnerability has been resolved:
memfd: deny... |
high | 8.4 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-77496 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-63946 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-72969 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85339 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72968 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85341 Heap-based buffer overflow in Windows USB Video Driver allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72955 Use after free in Windows Application Compatibility Cache allows an authorized a... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85342 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-72934 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85343 Improper link resolution before file access ('link following') in Windows Hyper-... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83510 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85352 Use after free in Windows Device Association Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83509 Untrusted search path in Windows Setup Files Cleanup allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85353 Out-of-bounds read in Windows Print Spooler Components allows an unauthorized at... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83505 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85354 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-73027 External control of system or configuration setting in Windows Setup Files Clean... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85355 Inclusion of functionality from untrusted control sphere in Windows Common Log F... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83499 Insufficient granularity of access control in Windows Server Update Service allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85356 Out-of-bounds read in Windows Volume Manager Extension Driver allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81969 Insufficient granularity of access control in Windows Server Update Service allo... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-83508 Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate priv... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-81971 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-71347 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70580 Missing authentication for critical function in Windows Credential Guard allows... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.