October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108429 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108430 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108431 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108432 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108433 Reliance on untrusted inputs in a security decision in Microsoft Office Word all... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108437 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108439 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108440 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108441 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-108442 Use after free in Microsoft Office Word allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-20 |
| CVE-2026-83531 Improper Control of Generation of Code ('Code Injection'), Improper Neutralizati... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-88753 A Regular-Expression Denial of Service (ReDoS) in the Markdown2. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-97394 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-58390 OPNsense is a FreeBSD based firewall and routing platform. |
high | 8.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-57489 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110856 GitPython before 3.2.0 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110668 A weakness has been identified in cemtan sar2html 4.0.0. |
high | 7.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103977 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-104108 FileRise is a self-hosted web-based file manager with multi-file upload, editing... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109430 Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) in... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-91157 Discourse is an open-source discussion platform. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-91159 Discourse is an open-source discussion platform. |
high | 7.7 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-92150 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-54554 FOG is a free open-source cloning/imaging/rescue suite/inventory management syst... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-73260 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110646 Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vuln... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110719 Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110616 NullHub through 2026.5.29 contains a missing authentication vulnerability that a... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110621 Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in Pro... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110641 @runnerty/executor-decompress through 3.1.1 contains an OS command injection vul... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-103043 anchorme through 3.0.8 contains a regular expression denial of service vulnerabi... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-20 |
| CVE-2026-102695 OmniFaces is a utility library for Faces. |
high | 8.2 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-109527 The Model Context Protocol Python SDK is the official Python SDK for Model Conte... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2016-15060 A vulnerability was found in PCMan FTP Server up to 2.0.7. |
high | 8.3 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-84506 A use after free issue was addressed with improved memory management. |
high | 7.8 | — | Apple / macos | 2026-09-14 | 2026-10-20 |
| CVE-2026-88160 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88161 Use after free in Windows Local Security Authority (LSA) allows an authorized at... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88165 Out-of-bounds write in Active Directory Domain Services allows an authorized att... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88168 Heap-based buffer overflow in Windows Bind Filter Driver allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.