October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70086 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-70089 Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-59185 identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kube... |
high | 8.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114094 Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree pat... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-115596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-115612 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-116393 Missing Authorization vulnerability in iHomefinder, Inc. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-114081 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL que... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114084 Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtim... |
high | 7.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114089 Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114059 ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allo... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114066 Trigger.dev before 4.7.0 contains a missing authorization vulnerability that all... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114069 Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-112399 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112404 Pillow is a Python imaging library. |
high | 8.2 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112893 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-112395 Pillow is a Python imaging library. |
high | 8.2 | — | Python / pillow | 2026-10-19 | 2026-10-28 |
| CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111044 Sunshine is a self-hosted game stream host for Moonlight. |
high | 7.6 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2016-20103 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-98116 In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-105733 Improper access control in Windows Hyper-V allows an authorized attacker to exec... |
high | 8.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-98117 In the Linux kernel, the following vulnerability has been resolved:
cachefiles:... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-98118 In the Linux kernel, the following vulnerability has been resolved:
netfs: Fix... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-28 |
| CVE-2026-116173 vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116178 vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that a... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116179 vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that... |
high | 7.5 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-116180 vLLM from 0.8.5 before 0.31.0 has a denial of service flaw. |
high | 7.7 | — | Vllm / vllm | 2026-10-25 | 2026-10-28 |
| CVE-2026-115912 vLLM is an inference and serving engine for large language models. |
high | 8.8 | — | Vllm / vllm | 2026-10-26 | 2026-10-28 |
| CVE-2026-65327 A logic issue was addressed with improved checks. |
high | 8.4 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-96521 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-28 |
| CVE-2026-86929 An out-of-bounds write issue was addressed with improved bounds checking. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-28 |
| CVE-2026-110747 ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry'... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118485 Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding (htt... |
high | 8.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-63286 Database backups are vulnerable to offline attacks. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93518 An integer truncation issue in XkbResizeKeyType() that could lead to a heap buff... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93519 A buffer overflow when handling pointer barriers in the XFIXES extension in X.Or... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-93520 A heap buffer overflow caused by mismatching size calculations between XkbAllocN... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2013-20007 Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability t... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.