October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-76001 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-102209 Heap-based buffer overflow in Microsoft Graphics Component allows an authorized... |
high | 7.0 | — | Microsoft / windows 11 26h1 | 2026-10-13 | 2026-10-20 |
| CVE-2026-79609 XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-57... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-79610 XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain
other... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-68572 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apac... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-112377 CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-110005 The `periphery` agent's container-management functionality of Komodo version 2.2... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102702 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102699 [This CNA information record relates to multiple CVEs; the
text explains which a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-102211 Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102189 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102191 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102192 Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an una... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102193 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-102194 Use after free in Windows Graphics Kernel allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-98155 In the Linux kernel, the following vulnerability has been resolved:
accel/qaic:... |
high | 7.1 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-102195 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-71169 Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permis... |
high | 7.0 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-16753 Incorrect authorization in the library-query execution endpoint in Lowcoder vers... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-112772 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112777 Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112782 Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exha... |
high | 7.5 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-112252 A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-O... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-107082 Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticate... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-101292 Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerabilit... |
high | 8.2 | — | — | 2026-09-28 | 2026-10-20 |
| CVE-2026-104937 Shopware version 6.7 allows the upload of attacker‑controlled HTML files and ser... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N... |
high | 7.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-102196 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-98154 In the Linux kernel, the following vulnerability has been resolved:
nvme-rdma:... |
high | 7.0 | — | Linux / linux kernel | 2026-09-25 | 2026-10-20 |
| CVE-2026-102197 Use after free in Windows Broadcast DVR User Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88164 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-14 | 2026-10-20 |
| CVE-2026-71170 Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Pa... |
high | 7.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111999 Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that a... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-20 |
| CVE-2026-109587 Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in Free... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-111723 LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerabil... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-100200 Use after free in Windows Update Service allows an authorized attacker to elevat... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100201 Heap-based buffer overflow in Windows Client License Service allows an authorize... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100203 Heap-based buffer overflow in Windows Update Service allows an authorized attack... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100215 Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.