October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112151 A weakness has been identified in vraj404 Criminal Management System up to 2808d... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112152 A security vulnerability has been detected in vraj404 Criminal-Management-System... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112153 A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d05... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111225 Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerab... |
high | 8.8 | — | Pfsense / pfsense | 2026-10-15 | 2026-10-19 |
| CVE-2026-108443 Off-by-one error in Microsoft Office Word allows an unauthorized attacker to exe... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108444 Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker t... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108445 Stack-based buffer overflow in Microsoft Office Word allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108446 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-87018 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-87029 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-108447 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-67404 RabbitMQ is a messaging and streaming broker. |
high | 7.4 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108448 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized at... |
high | 7.5 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-67232 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108449 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108450 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-66079 RabbitMQ is a messaging and streaming broker. |
high | 7.5 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-66070 RabbitMQ is a messaging and streaming broker. |
high | 8.8 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-108451 Numeric truncation error in Microsoft Office Word allows an unauthorized attacke... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-15 | 2026-10-19 |
| CVE-2026-108452 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-15 | 2026-10-19 |
| CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-52023 An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a deni... |
high | 7.5 | — | Kamailio / kamailio | 2026-09-01 | 2026-10-19 |
| CVE-2026-110450 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair... |
high | 8.0 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-107302 msgpack5 is a msgpack v5 implementation for node.js and the browser. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-19 |
| CVE-2026-67405 RabbitMQ is a messaging and streaming broker. |
high | 8.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-67233 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-24 | 2026-10-19 |
| CVE-2026-110919 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110920 Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110921 Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-110922 Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a re... |
high | 8.8 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-70012 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-83934 Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-75353 OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side E... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-42616 In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c... |
high | 7.8 | — | Tuxera / ntfs-3g | 2026-10-07 | 2026-10-19 |
| CVE-2026-50218 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improp... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-112018 cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_ac... |
high | 7.0 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112142 A vulnerability was identified in satya-vinay Events-Management-System up to 437... |
high | 7.3 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111445 Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles token... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110373 Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone nu... |
high | 8.1 | — | — | 2026-10-18 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.