October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,927
Critical
3,121
High
7,064
Medium
6,895
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95710 An unauthenticated buffer overflow vulnerability exists in the underlying operat... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95711 An authentication bypass vulnerability in the web-based management interface of... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95712 A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 c... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-95713 An unauthenticated buffer overflow vulnerability exists in the command line inte... |
high | 7.0 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-74041 Wazuh 4.14.3 before 4.14.8 and 4.10.4 contains a case-sensitivity mismatch betwe... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability th... |
high | 7.6 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115948 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-115608 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-108456 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized atta... |
high | 7.7 | — | — | 2026-10-22 | 2026-10-26 |
| CVE-2026-115778 Twisted is an event-based framework for internet applications, supporting Python... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-115251 The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upg... |
high | 7.2 | — | — | 2026-10-25 | 2026-10-26 |
| CVE-2026-83924 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-112207 The Download Monitor WordPress plugin before 5.3.4 does not properly validate th... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-113673 The GeoDirectory WordPress plugin before 2.8.194 does not properly escape admini... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112844 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-112869 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114178 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114179 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114694 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114191 Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for... |
high | 7.5 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-114704 Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevans... |
high | 7.2 | — | — | 2026-10-24 | 2026-10-26 |
| CVE-2026-111841 Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp... |
high | 8.8 | — | — | 2026-10-26 | 2026-10-26 |
| CVE-2026-83927 Improper link resolution before file access ('link following') in Windows Regist... |
high | 7.8 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83928 Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83929 Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute co... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83930 Use after free in Windows Update Orchestrator Service allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83931 Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-26 |
| CVE-2026-83932 Heap-based buffer overflow in Windows Group Policy allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerability |
high | 8.8 | Listed | Microsoft / SharePoint | 2026-08-11 | 2026-10-26 |
| CVE-2026-20349 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Thre... |
high | 8.6 | Listed | Cisco / Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | 2026-08-11 | 2026-10-26 |
| CVE-2026-68820 Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabi... |
high | 7.0 | Listed | Microsoft / Windows Ancillary Function Driver for WinSock | 2026-08-11 | 2026-10-26 |
| CVE-2026-80465 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All v... |
high | 8.7 | — | — | 2026-09-03 | 2026-10-26 |
| CVE-2026-20236 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-26 |
| CVE-2026-98945 In the Linux kernel, the following vulnerability has been resolved:
HID: steam:... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-98911 In the Linux kernel, the following vulnerability has been resolved:
dpaa2-switc... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-98899 In the Linux kernel, the following vulnerability has been resolved:
netfilter:... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-98889 In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwi... |
high | 7.8 | — | — | 2026-10-23 | 2026-10-26 |
| CVE-2026-98895 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: H... |
high | 7.0 | — | — | 2026-10-23 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.