October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70236 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70243 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70249 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70253 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-22 |
| CVE-2026-70273 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-22 |
| CVE-2026-111851 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection... |
high | 7.6 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-112304 docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pre... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112309 @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPat... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-22 |
| CVE-2026-112145 A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-r... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112263 Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerabi... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112150 A security flaw has been discovered in vraj404 Criminal-Management-System up to... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112141 A vulnerability was determined in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-22 |
| CVE-2026-112000 Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the... |
high | 7.6 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-112005 WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows... |
high | 7.7 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-111873 A vulnerability was detected in itsmeravitejak Online-Examination-System up to e... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-22 |
| CVE-2026-114664 Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-22 |
| CVE-2026-59970 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111855 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 7.5 | — | — | 2026-10-17 | 2026-10-21 |
| CVE-2026-111684 Magistrala through 1.0.0 contains an authorization bypass vulnerability that all... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111634 Helical Insight through 7.0.0 contains an sql injection vulnerability that allow... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111639 bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111644 Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerabilit... |
high | 7.3 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-101683 Vulnerability in the Applications DBA product of Oracle E-Business Suite (compon... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101687 Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of O... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101680 Vulnerability in the Oracle Communications Billing and Revenue Management produc... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101681 Vulnerability in the Applications DBA product of Oracle E-Business Suite (compon... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101640 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (compon... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-101660 Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Su... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-98149 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pe... |
high | 7.8 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-98150 In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix BP... |
high | 7.0 | — | Linux / linux kernel | 2026-09-25 | 2026-10-21 |
| CVE-2026-95168 An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary cod... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-102214 Use after free in Windows Hyper-V allows an authorized attacker to execute code... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102215 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102216 Access of resource using incompatible type ('type confusion') in Windows StateRe... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-102217 Improper resolution of path equivalence in WebDAV allows an authorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-113043 Use after free in iOSWeb in Google Chrome on on iOS prior to 156.0.8078.47 allow... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-70285 Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.