October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70566 Null pointer dereference in Windows Schannel allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70299 Improper access control in Windows Bind Filter Driver allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70286 Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85357 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70278 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85358 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85359 Improper control of generation of code ('code injection') in Windows Performance... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70272 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85361 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70258 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85362 Release of invalid pointer or reference in Windows Management Instrumentation al... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70255 Heap-based buffer overflow in Desktop Window Manager allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70252 Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70229 Incorrect authorization in Active Directory Domain Services allows an unauthoriz... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70228 Out-of-bounds read in Desktop Window Manager allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70207 Heap-based buffer overflow in Network Policy Server (NPS) allows an authorized a... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70250 Use after free in Windows DHCP Client allows an unauthorized attacker to execute... |
high | 8.8 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85364 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70123 Numeric truncation error in Microsoft Graphics Component allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85366 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-85367 Use after free in Windows Cash Drawer Protocol Provider allows an authorized att... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-91212 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 8.6 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-28 |
| CVE-2026-91211 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 8.7 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-28 |
| CVE-2026-83526 The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-28 |
| CVE-2026-74969 Race condition, use-after-free in the Layout: Text and Fonts component. |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74949 Use-after-free in the Graphics: Canvas2D component. |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-74946 Information disclosure due to incorrect boundary conditions in the Graphics: Can... |
high | 8.8 | — | Mozilla / firefox | 2026-08-18 | 2026-10-28 |
| CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 8.1 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-57186 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117609 rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in pr... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117601 Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in uncon... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117568 mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that all... |
high | 7.0 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117560 ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnera... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117515 A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8... |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-117512 A vulnerability was found in oretnom23 php-travel-agency-system. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-116690 MLflow is an open source AI engineering platform for agents, large language mode... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-28 |
| CVE-2026-114403 PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vul... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114256 A weakness has been identified in oretnom23 file-management-system-php up to 2e3... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114243 A security flaw has been discovered in dhikshitha29 Insurance-Management-System... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.