October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,927
Critical
3,121
High
7,064
Medium
6,895
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112396 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
| CVE-2026-112392 Pillow is a Python imaging library. |
high | 7.5 | — | Python / pillow | 2026-10-19 | 2026-10-26 |
| CVE-2026-85911 Use after free in Windows StateRepository API allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-85912 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70112 Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacke... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70113 Integer overflow or wraparound in Windows Client for NFS allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70008 Integer overflow or wraparound in Windows IP Over USB Service allows an authoriz... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-70010 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-20293 A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implem... |
high | 7.1 | — | Cisco / enterprise nfv infrastructure software | 2026-09-08 | 2026-10-26 |
| CVE-2026-69765 Use after free in Windows Storport Miniport Driver allows an unauthorized attack... |
high | 8.8 | — | Microsoft / windows server 2025 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69766 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69783 External control of file name or path in Windows Update allows an authorized att... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69795 Null pointer dereference in Windows Clipboard Server allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-91527 Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91515 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91517 Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Ora... |
high | 8.0 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91520 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91521 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-69798 Use after free in Windows Wired AutoConfig Service allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-91511 Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (compo... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-91512 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-69830 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69840 Use after free in Windows Certificates allows an authorized attacker to elevate... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-33521 There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 a... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116368 A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115728 @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of se... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115908 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.4 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115909 zip is a zip library for Rust that supports reading and writing simple ZIP files... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115347 Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerabilit... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115349 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of ser... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-110205 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-26 |
| CVE-2026-109782 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109783 Mitigation bypass in the File Handling component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier th... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109961 Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that all... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-109428 Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-107084 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site requ... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-26 |
| CVE-2026-105608 HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-105626 HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-69850 Untrusted pointer dereference in Windows Certificates allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.