October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,924
Critical
3,121
High
7,062
Medium
6,894
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76495 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76496 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.0 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76476 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-76477 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-20291 As part of Cisco's ongoing commitment to proactive security and product quality,... |
high | 7.8 | — | — | 2026-10-21 | 2026-10-22 |
| CVE-2026-113019 Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-22 |
| CVE-2026-96959 Allocation of resources without limits or throttling in .NET allows an unauthori... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96960 Asymmetric resource consumption (amplification) in .NET allows an unauthorized a... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96957 Improper verification of cryptographic signature in .NET allows an unauthorized... |
high | 8.8 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96958 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | Microsoft / .net | 2026-10-13 | 2026-10-22 |
| CVE-2026-96232 Out-of-bounds read in .NET allows an unauthorized attacker to disclose informati... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96233 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96235 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96237 Inclusion of functionality from untrusted control sphere in .NET allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96222 Improper certificate validation in Active Directory Federation Services (AD FS)... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-96224 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96225 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96230 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-96231 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-87697 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-85363 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-84008 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-83520 Deserialization of untrusted data in .NET allows an unauthorized attacker to exe... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70190 Improper link resolution before file access ('link following') in .NET allows an... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70179 Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70174 Improperly implemented security check for standard in .NET allows an unauthorize... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70159 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70161 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70035 Deserialization of untrusted data in .NET Framework allows an unauthorized attac... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-70007 Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-69651 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-113386 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP comm... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113394 A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112940 filelock is a platform-independent file lock for Python. |
high | 7.1 | — | Tox-dev / filelock | 2026-10-20 | 2026-10-22 |
| CVE-2026-111765 A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. |
high | 7.5 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-109468 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-109440 LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-6554 libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a sig... |
high | 7.5 | — | — | 2026-09-05 | 2026-10-22 |
| CVE-2026-112775 Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerabili... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.