October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,924
Critical
3,121
High
7,062
Medium
6,894
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-56833 PraisonAI is a multi-agent teams system. |
high | 7.5 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-56837 PraisonAI is a multi-agent teams system. |
high | 8.6 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-115352 Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inl... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115570 Electron is a framework for writing cross-platform desktop applications using Ja... |
high | 7.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-114613 MessagePack is the serializer implementation for Python msgpack.org. |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-115348 Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112330 Motor.NET before 0.19.0 contains a denial of service vulnerability that allows a... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-112342 Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/h... |
high | 7.1 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-12148 IBM MQ Operator could allow an authenticated attacker to cause a denial of servi... |
high | 8.8 | — | Ibm / mq operator | 2026-10-19 | 2026-10-23 |
| CVE-2026-110839 FreeRDP 3.3.0 before 3.32.0, when built with WINPR_UTILS_IMAGE_JPEG=ON, has a he... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110837 FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OF... |
high | 7.1 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110838 FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110833 FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute s... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-110830 FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-14 | 2026-10-23 |
| CVE-2026-111312 OpenHealth through 0.2.0 contains a missing authentication and authorization vul... |
high | 7.7 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111352 ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in Rest... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-111280 snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7Micro... |
high | 7.4 | — | — | 2026-10-15 | 2026-10-23 |
| CVE-2026-13599 Missing authentication for critical function vulnerability in ABB Ability Edgeni... |
high | 7.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110491 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110825 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts ho... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-63120 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup dat... |
high | 8.4 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-69673 Improper link resolution before file access ('link following') in Windows Update... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69718 Improper neutralization of special elements used in a command ('command injectio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69733 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108132 Double free in Windows Kerberos allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108135 Improper link resolution before file access ('link following') in Windows Backup... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108136 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-108396 Time-of-check time-of-use (toctou) race condition in Windows Modern Device Manag... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-23 |
| CVE-2026-111633 ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-113873 SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-113874 SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identi... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-111613 AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability t... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-42018 JFrog Artifactory Improper Authentication Vulnerability |
high | 7.5 | Listed | JFrog / Artifactory | 2026-08-12 | 2026-10-23 |
| CVE-2026-98093 In the Linux kernel, the following vulnerability has been resolved:
ASoC: fsl_m... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-23 |
| CVE-2026-83862 Use after free in Windows Network Load Balancing allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-68836 Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69326 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69354 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69363 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69387 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.