October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,927
Critical
3,121
High
7,064
Medium
6,895
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-117602 Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plu... |
high | 8.4 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-108458 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-116723 FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BM... |
high | 7.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-108464 Use after free in Software Protection Platform (SPP) allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-108467 Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an auth... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-109453 Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69577 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69789 Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allow... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69802 Weak authentication in Network Device Enrollment Service (NDES) allows an unauth... |
high | 8.1 | — | Microsoft / windows server 2012 | 2026-10-13 | 2026-10-27 |
| CVE-2026-28167 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-08-24 | 2026-10-27 |
| CVE-2026-116818 OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vuln... |
high | 8.2 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116620 A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. |
high | 7.3 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116587 Go JOSE provides an implementation of the Javascript Object Signing and Encrypti... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-69986 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-106174 A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 throug... |
high | 7.5 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-116898 REDAXO before 5.21.4 contains a missing authorization vulnerability in the media... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-27 |
| CVE-2026-112405 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112406 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112891 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112892 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112894 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112895 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-112896 Pillow is a Python imaging library. |
high | 7.1 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-69987 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-27 |
| CVE-2026-112901 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-27 |
| CVE-2026-97164 Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `cle... |
high | 8.1 | — | Svenbluege / event gallery | 2026-09-27 | 2026-10-27 |
| CVE-2026-100750 Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.... |
high | 7.5 | — | Regularlabs / modules anywhere | 2026-09-28 | 2026-10-27 |
| CVE-2026-91494 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 7.4 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91493 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 7.5 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91492 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 8.7 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91489 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 7.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-91488 Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion... |
high | 7.1 | — | Oracle / identity manager connector | 2026-10-20 | 2026-10-27 |
| CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
| CVE-2026-91653 Vulnerability in Oracle Essbase (component: Essbase Web Platform). |
high | 8.5 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-83366 Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suit... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-83370 Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auc... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-7025 A vulnerability was found in Typecho up to 1.3.0. |
high | 7.3 | — | — | 2026-04-26 | 2026-10-27 |
| CVE-2026-113728 Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. |
high | 7.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos b... |
high | 8.7 | — | Traefik / traefik | 2026-10-22 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.