October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6064 Link following vulnerability in Data Shredder components in Norton Antivirus, Av... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87364 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-103600 Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) i... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103601 Release of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (K... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63575 Loop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12Parame... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63576 Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromU... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63577 Improper certificate validation in the directoryName name-constraint check (Pkix... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-63578 Allocation of resources without limits in password-based private-key decryption... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-87358 Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (c... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87359 Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (com... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-87357 Vulnerability in the Order Capture product of Oracle E-Business Suite (component... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-68567 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-08-18 | 2026-10-28 |
| CVE-2026-114096 Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in p... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2026-114106 HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerabili... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-66974 An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Applic... |
high | 7.5 | — | — | 2026-09-15 | 2026-10-28 |
| CVE-2025-66969 Integer overflow in OpenModSim (<=1.11.0), leading to denial of service |
high | 7.5 | — | — | 2026-10-16 | 2026-10-28 |
| CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-28 |
| CVE-2025-71436 Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffe... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2025-31699 Apache Traffic Server can return an origin connection to the shared pool while t... |
high | 8.9 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-55702 When a client sends a POST with Expect: 100-continue and the origin answers befo... |
high | 8.7 | — | — | 2026-10-21 | 2026-10-28 |
| CVE-2025-61479 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1... |
high | 7.5 | — | — | 2026-08-26 | 2026-10-28 |
| CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1... |
high | 7.5 | — | — | 2026-08-26 | 2026-10-28 |
| CVE-2026-118035 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118036 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118037 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118038 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118039 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-118040 In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-67073 HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Co... |
high | 8.6 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-63947 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-28 |
| CVE-2026-108130 Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclav... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108133 Release of invalid pointer or reference in Windows Modern Device Management (MDM... |
high | 7.8 | — | Microsoft / windows server 2022 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108134 Use after free in Windows Autopilot allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-108399 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 7.2 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69650 Improper verification of cryptographic signature in Windows Key Distribution Cen... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69743 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-28 |
| CVE-2026-69763 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-28 |
| CVE-2026-103603 Memory allocation with excessive size value in the HSS/LMS signature code (HssPu... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
| CVE-2026-103604 Inefficient algorithmic complexity in X.509 distinguished name string conversion... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.