October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,927
Critical
3,121
High
7,064
Medium
6,895
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2014-125135 A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-69856 Use after free in Windows Storage allows an authorized attacker to elevate privi... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69884 Buffer over-read in Windows GDI allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108457 Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108460 Use after free in Windows Message Queuing allows an unauthorized attacker to exe... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108461 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108463 Improper resolution of path equivalence in Windows SmartScreen allows an unautho... |
high | 8.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108465 Use after free in Windows Update Delivery Optimization allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108468 Use after free in Windows Installer allows an authorized attacker to elevate pri... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-108471 Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enc... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-49785 Improper resource shutdown or release in Windows UEFI allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability |
high | 8.8 | Listed | BerriAI / LiteLLM | 2026-05-08 | 2026-10-26 |
| CVE-2026-6973 Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability |
high | 7.2 | Listed | Ivanti / Endpoint Manager Mobile (EPMM) | 2026-05-07 | 2026-10-26 |
| CVE-2026-19667 If an attacker-controlled authoritative server can produce a negative answer tha... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-81563 A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or mo... |
high | 7.5 | — | — | 2026-09-16 | 2026-10-26 |
| CVE-2026-74757 Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (vers... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-110215 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110220 Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vu... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerabili... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110111 Xen Orchestra before 6.9.0 contains an improper access control vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-116199 Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController:... |
high | 8.1 | — | Snipeitapp / snipe-it | 2026-10-25 | 2026-10-26 |
| CVE-2026-112345 TTLock Android application before v9.8.260718 and associated smart-lock firmware... |
high | 8.1 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116339 A vulnerability was determined in iFlytek astron-agent up to 1.1.2. |
high | 7.3 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-116011 Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-98143 In the Linux kernel, the following vulnerability has been resolved:
accel: etho... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-26 |
| CVE-2026-72753 When Routinator encounters an RRDP notification file with gaps in the delta entr... |
high | 8.2 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72754 When Routinator encounters a CRL with many entries, it may hang or run out of me... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72756 Routinator exits when an rsync URI for a file obtained over RRDP contains a path... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-72758 When parsing an AS range in Routinator, if the maximum value of the range is sma... |
high | 7.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-93441 IBM QRadar SIEM could allow a remote attacker to cause a denial of service due t... |
high | 8.6 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-65825 OpenReception's appointment booking software provides an end-to-end encrypted ap... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-50787 e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource con... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-116019 Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-116049 A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d20827... |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-116000 A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. |
high | 7.3 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-110690 Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path trav... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110018 The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Buil... |
high | 8.8 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-102941 The package github.com/gomarkdown/markdown is a Go library for parsing Markdown... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-26 |
| CVE-2021-48012 fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows... |
high | 8.2 | — | — | 2026-10-12 | 2026-10-26 |
| CVE-2026-105133 Ahsay AhsayCBS Improper Authentication Vulnerability |
high | 7.3 | Listed | Ahsay / AhsayCBS | 2026-10-04 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.