October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109760 Mitigation bypass in the Networking: HTTP component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109766 Mitigation bypass in the Enterprise Policies component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Route... |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-69992 Use after free in Windows Remote Desktop Services allows an unauthorized attacke... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2025-62593 Ray-Project Ray Code Injection Vulnerability |
high | 8.8 | Listed | Ray-Project / Ray | 2025-11-26 | 2026-10-19 |
| CVE-2026-69994 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69995 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69996 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69997 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69998 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70004 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-70013 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-89067 Authentication bypass using an alternate path or channel vulnerability in Progre... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89070 Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfe... |
high | 7.5 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89071 Improper neutralization of special elements used in an LDAP query ('LDAP injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89072 Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certif... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-109744 Other issue in the DOM: File component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109737 Mitigation bypass in the Enterprise Policies component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109734 Mitigation bypass in the DOM: Security component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109736 Frame poisoning in the Layout component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109720 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-89074 Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89075 Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Trans... |
high | 7.3 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89076 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-89077 Incorrect implementation of authentication algorithm vulnerability in Progress M... |
high | 8.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-68571 Improper Control of Generation of Code ('Code Injection') vulnerability in Apach... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-98369 In the Linux kernel, the following vulnerability has been resolved:
xfrm: add m... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98364 In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98366 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: v... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98367 In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: C... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98368 In the Linux kernel, the following vulnerability has been resolved:
esp: downgr... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98357 In the Linux kernel, the following vulnerability has been resolved:
IB/isert: w... |
high | 8.1 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98359 In the Linux kernel, the following vulnerability has been resolved:
RDMA/core:... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98360 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: i... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98361 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: R... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98348 In the Linux kernel, the following vulnerability has been resolved:
wifi: libip... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98349 In the Linux kernel, the following vulnerability has been resolved:
wifi: libip... |
high | 7.1 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98339 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
high | 8.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98341 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98330 In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80... |
high | 7.0 | — | — | 2026-10-06 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.