October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-44599 FNT Command 13.4.0 is vulnerable to Directory Traversal. |
high | 8.3 | — | Fntsoftware / fnt command | 2025-12-15 | 2026-10-27 |
| CVE-2024-29371 In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) conditio... |
high | 7.5 | — | Jose4j Project / jose4j | 2025-12-17 | 2026-10-27 |
| CVE-2024-46062 Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalatio... |
high | 7.8 | — | Conda / miniconda3 | 2025-12-17 | 2026-10-27 |
| CVE-2024-24844 Missing Authorization vulnerability in IdeaBox Creations PowerPack Pro for Eleme... |
high | 7.5 | — | — | 2025-12-23 | 2026-10-27 |
| CVE-2024-9684 FreyrSCADA/IEC-60870-5-104 server v21.06.008 allows remote attackers to cause a... |
high | 7.5 | — | — | 2025-12-23 | 2026-10-27 |
| CVE-2024-30855 DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulne... |
high | 8.8 | — | Dedecms / dedecms | 2025-12-29 | 2026-10-27 |
| CVE-2024-25183 givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php. |
high | 7.5 | — | Vvveb / vvvebjs | 2025-12-29 | 2026-10-27 |
| CVE-2024-43384 A low privileged remote attacker can gain the root password due to improper remo... |
high | 8.0 | — | Phoenixcontact / fl mguard 2102 firmware | 2026-05-07 | 2026-10-27 |
| CVE-2024-36333 A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker... |
high | 7.8 | — | Amd / radeon software | 2026-05-15 | 2026-10-27 |
| CVE-2024-32386 Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v... |
high | 7.3 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-34268 EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the late... |
high | 7.1 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-58362 SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary... |
high | 8.8 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58368 SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS header... |
high | 7.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-51316 The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the... |
high | 7.5 | — | — | 2026-07-20 | 2026-10-27 |
| CVE-2026-64239 In the Linux kernel, the following vulnerability has been resolved:
mm/damon/sy... |
high | 7.8 | — | Linux / linux kernel | 2026-07-24 | 2026-10-27 |
| CVE-2024-6832 The account locking mechanism fails to trigger when secondary user stores are in... |
high | 7.5 | — | Wso2 / api control plane | 2026-08-06 | 2026-10-27 |
| CVE-2024-39024 In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote... |
high | 8.8 | — | — | 2026-08-06 | 2026-10-27 |
| CVE-2026-101411 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 8.1 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101416 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101428 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.5 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-101429 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleS... |
high | 7.0 | — | Oracle / peoplesoft enterprise peopletools | 2026-10-20 | 2026-10-27 |
| CVE-2026-103555 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103575 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-103577 Insecure default variable initialization in Microsoft QUIC allows an unauthorize... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-27 |
| CVE-2026-105003 Heap-based buffer overflow in HID class driver allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-109431 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing autho... |
high | 8.1 | — | — | 2026-10-19 | 2026-10-27 |
| CVE-2026-87694 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-87695 Inclusion of functionality from untrusted control sphere in Microsoft Exchange S... |
high | 7.8 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
| CVE-2026-87696 Improper verification of cryptographic signature in Microsoft Exchange Server al... |
high | 7.5 | — | Microsoft / exchange server | 2026-10-13 | 2026-10-27 |
| CVE-2026-87699 Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-15999 Improper validation of integrity check value in the AES-CCM implementation (CcmP... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-16000 Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCi... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-16001 Exposure of the message authentication key through the encryption keystream in t... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63566 Memory allocation with excessive size value in the DTLS handshake reassembly (Dt... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63567 Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-63568 Allocation of resources without limits or throttling in the CMP/CRMF password-ba... |
high | 7.5 | — | Bouncycastle / bc-csharp | 2026-10-02 | 2026-10-27 |
| CVE-2026-116738 VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode funct... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-116747 Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerability that a... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-117561 Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-117569 Kali-GPT through commit a608c74 contains an OS command injection vulnerability i... |
high | 7.8 | — | — | 2026-10-27 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.