October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112301 A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. |
high | 7.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112360 A security vulnerability has been detected in Netis EAP930 1.250905.115454. |
high | 8.0 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-93300 The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injec... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113381 A weakness has been identified in Osclass up to 8.3.1. |
high | 7.3 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113392 A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113395 A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113396 A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-113397 A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-112836 Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikRentCar vikrentca... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-94450 Improper validation of the Destination Connection ID length in s2n-quic 1.88.0 a... |
high | 7.5 | — | — | 2026-09-22 | 2026-10-20 |
| CVE-2026-86830 Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) fo... |
high | 7.2 | — | — | 2026-09-14 | 2026-10-20 |
| CVE-2026-86831 Improper validation of pod identifier uniqueness in aws-network-policy-agent in... |
high | 8.7 | — | — | 2026-09-16 | 2026-10-20 |
| CVE-2026-78497 JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's r... |
high | 8.4 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-69076 Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69077 Exposure of unauthorized cross-project job manipulation vulnerability in Apache... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-69080 Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kyli... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-68498 StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to b... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-64943 Insertion of Sensitive Information into Log File vulnerability in Apache Answer. |
high | 8.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110758 Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110752 Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110755 Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying th... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109588 Numeric truncation of the buffer length in the MPU buffer authorization check in... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-108984 A vulnerability is in Web Server default connection ports under the process name... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-104679 VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML externa... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-102204 Improper link resolution before file access ('link following') in Windows Subsys... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-34633 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-34634 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-71385 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.4 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-75748 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-84884 IBM Guardium Data Protection 12.2 stores internal REST service-account passwords... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-84862 IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in t... |
high | 7.2 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-85542 IBM Guardium Data Protection 12.2 is affected by a command injection vulnerabili... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-75995 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.4 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-85029 IBM Guardium Data Protection 12.2 could allow a remote attacker to obtain sensit... |
high | 8.8 | — | Ibm / guardium data protection | 2026-09-25 | 2026-10-20 |
| CVE-2026-102201 Use after free in Microsoft Windows Media Foundation allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102202 Improper access control in Windows Container Isolation FS Filter Driver (unionfs... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102203 Access of resource using incompatible type ('type confusion') in RPC Runtime all... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102205 Heap-based buffer overflow in Windows Universal Disk Format File System Driver (... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102207 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102208 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.