October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88171 Double free in Windows DHCP Server allows an unauthorized attacker to execute co... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88173 Use after free in Windows Background Intelligent Transfer Service (BITS) allows... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88174 Concurrent execution using shared resource with improper synchronization ('race... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88177 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88179 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88180 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88181 Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88193 Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-88219 Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96246 Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-96856 Heap-based buffer overflow in Windows Management Instrumentation allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. |
high | 8.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-87766 A flaw was found in bubblewrap. |
high | 8.8 | — | — | 2026-09-09 | 2026-10-20 |
| CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of... |
high | 7.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-83966 Substance3D - Sampler is affected by an out-of-bounds write vulnerability that c... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-10-13 | 2026-10-20 |
| CVE-2026-83965 Substance3D - Sampler is affected by a Stack-based Buffer Overflow vulnerability... |
high | 7.8 | — | Adobe / substance 3d sampler | 2026-10-13 | 2026-10-20 |
| CVE-2026-105898 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.2 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-103843 Substance3D - Stager is affected by a Use After Free vulnerability that could re... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103842 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103841 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-103840 Substance3D - Stager is affected by an out-of-bounds read vulnerability when par... |
high | 7.8 | — | Adobe / substance 3d stager | 2026-10-13 | 2026-10-20 |
| CVE-2026-82166 Dell Application Store, versions prior to 26.05.0.7, contain a Missing Authentic... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-49410 OpenHuman is an open-source agent harness available as a desktop application and... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-112773 Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerabilit... |
high | 8.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111924 Fleet before 4.83.0 contains a denial of service vulnerability that allows unaut... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111881 FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP... |
high | 7.6 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111897 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerab... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111908 phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111872 A security vulnerability has been detected in itsmeravitejak Online-Examination-... |
high | 7.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-111854 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2025-46418 Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media def... |
high | 7.6 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-15485 The Auto x LINE WordPress plugin through 1.0.0 does not have authorization check... |
high | 8.2 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-12737 The administrative operations within the Carbon Console do not adequately valida... |
high | 8.4 | — | Wso2 / api control plane | 2026-09-03 | 2026-10-19 |
| CVE-2025-9049 The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unaut... |
high | 8.8 | — | — | 2026-09-05 | 2026-10-19 |
| CVE-2025-15700 The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2025-71432 Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2026-109762 Incorrect boundary conditions in the SVG component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-59963 Tandoor Recipes is an application for managing recipes, planning meals, and buil... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111853 An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. |
high | 8.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111880 FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in... |
high | 7.4 | — | — | 2026-10-17 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.