October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-90321 In the Linux kernel, the following vulnerability has been resolved:
ocfs2: vali... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90291 In the Linux kernel, the following vulnerability has been resolved:
module/dups... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90260 In the Linux kernel, the following vulnerability has been resolved:
btrfs: zone... |
high | 7.1 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90240 In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d:... |
high | 8.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90256 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90217 In the Linux kernel, the following vulnerability has been resolved:
bpf: Compar... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90231 In the Linux kernel, the following vulnerability has been resolved:
apparmor: f... |
high | 8.4 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90177 In the Linux kernel, the following vulnerability has been resolved:
bpf: Check... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90142 In the Linux kernel, the following vulnerability has been resolved:
virtio_net:... |
high | 7.8 | — | — | 2026-09-17 | 2026-10-21 |
| CVE-2026-90030 In the Linux kernel, the following vulnerability has been resolved:
usb: dwc3:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89929 In the Linux kernel, the following vulnerability has been resolved:
KVM: nVM: E... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89906 In the Linux kernel, the following vulnerability has been resolved:
LoongArch:... |
high | 7.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89913 In the Linux kernel, the following vulnerability has been resolved:
KVM: arm64:... |
high | 8.8 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89806 In the Linux kernel, the following vulnerability has been resolved:
drm/sysfb:... |
high | 8.4 | — | — | 2026-09-16 | 2026-10-21 |
| CVE-2026-89755 In the Linux kernel, the following vulnerability has been resolved:
mm/migrate_... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89705 In the Linux kernel, the following vulnerability has been resolved:
nfsd: resto... |
high | 7.1 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89632 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 8.2 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-89624 In the Linux kernel, the following vulnerability has been resolved:
HID: univer... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-80935 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
high | 8.8 | — | — | 2026-09-11 | 2026-10-21 |
| CVE-2026-80734 In the Linux kernel, the following vulnerability has been resolved:
btrfs: init... |
high | 8.8 | — | — | 2026-09-03 | 2026-10-21 |
| CVE-2026-83886 Use after free in Windows Update Orchestrator Service allows an authorized attac... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability |
high | 7.2 | Listed | Plex / Media Server | 2026-09-23 | 2026-10-21 |
| CVE-2026-83896 Heap-based buffer overflow in Windows Direct Composition allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83899 Improper privilege management in Windows Installer allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83900 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-21 |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability |
high | 7.5 | Listed | SolarWinds / Serv-U | 2026-06-04 | 2026-10-21 |
| CVE-2026-56449 Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with cr... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-21 |
| CVE-2026-86919 A stack overflow was addressed with improved input validation. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-86922 A type confusion issue was addressed with improved state management. |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-76740 A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms,... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-21 |
| CVE-2026-28328 SolarWinds Observability Self-Hosted was found to be affected by a broken author... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-105453 IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through... |
high | 8.4 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-92263 SparkyFitness is a self-hosted, AI-powered health and fitness tracker for famili... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-48741 libIEC61850 is an open-source implementation of IEC 61850 client and server prot... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111380 FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audi... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-21 |
| CVE-2026-111447 Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary k... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-95183 An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-21 |
| CVE-2026-111359 CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerabi... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111160 LightLLM through 1.2.0 contains a denial of service vulnerability that allows un... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-21 |
| CVE-2026-111125 CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in... |
high | 7.1 | — | Nasa / cfitsio | 2026-10-15 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.