October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100216 Stack-based buffer overflow in Windows Storage allows an authorized attacker to... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100217 Improper privilege management in Windows Group Policy allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100218 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100220 Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100225 Heap-based buffer overflow in Windows Storage allows an authorized attacker to e... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-62895 Permissive cross-domain policy with untrusted domains in Azure Arc allows an una... |
high | 8.8 | — | Microsoft / azure arc sql server extension | 2026-09-08 | 2026-10-20 |
| CVE-2026-111218 Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111219 Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in s... |
high | 7.2 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-20 |
| CVE-2026-111373 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the w... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111378 FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption v... |
high | 7.5 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111381 FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persisten... |
high | 7.3 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-111382 FreeRDP before 3.32.0 contains a client-side heap out-of-bounds write vulnerabil... |
high | 8.8 | — | Freerdp / freerdp | 2026-10-16 | 2026-10-20 |
| CVE-2026-86047 MariaDB server is a community developed fork of MySQL server. |
high | 7.7 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-107807 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107808 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-112774 Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 7.2 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-109126 IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appl... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-107809 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107810 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107811 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107400 IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authen... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-107812 Nginx UI is a web user interface for the Nginx web server. |
high | 7.5 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-107813 Nginx UI is a web user interface for the Nginx web server. |
high | 8.8 | — | Nginxui / nginx ui | 2026-10-09 | 2026-10-20 |
| CVE-2026-63690 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-81452 Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Lea... |
high | 7.0 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-79985 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-78165 Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis com... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-79984 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.4 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-67225 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67230 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-67270 Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Impro... |
high | 7.4 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-108743 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth... |
high | 8.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operat... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-102855 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-20 |
| CVE-2026-108426 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108427 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108428 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.