October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,899
Critical
3,119
High
7,046
Medium
6,890
Low
606
Severity not reported
4,238
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-80952 In the Linux kernel, the following vulnerability has been resolved:
i3c: master... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80953 In the Linux kernel, the following vulnerability has been resolved:
i3c: master... |
high | 8.4 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80954 In the Linux kernel, the following vulnerability has been resolved:
i3c: Fix un... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80955 In the Linux kernel, the following vulnerability has been resolved:
dm-pcache:... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80943 In the Linux kernel, the following vulnerability has been resolved:
wifi: rtlwi... |
high | 7.6 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80944 In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifi... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80931 In the Linux kernel, the following vulnerability has been resolved:
w1: ds28e17... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80932 In the Linux kernel, the following vulnerability has been resolved:
vsock/virti... |
high | 8.4 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80933 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80936 In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76:... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80924 In the Linux kernel, the following vulnerability has been resolved:
crypto: krb... |
high | 7.5 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80928 In the Linux kernel, the following vulnerability has been resolved:
smack: fix... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80929 In the Linux kernel, the following vulnerability has been resolved:
sysctl: mov... |
high | 7.8 | — | — | 2026-09-11 | 2026-10-19 |
| CVE-2026-80914 In the Linux kernel, the following vulnerability has been resolved:
Bluetooth:... |
high | 8.8 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-80921 In the Linux kernel, the following vulnerability has been resolved:
KVM: s390:... |
high | 8.8 | — | — | 2026-09-09 | 2026-10-19 |
| CVE-2026-85013 A flaw was found in environment-modules. |
high | 7.3 | — | — | 2026-09-15 | 2026-10-19 |
| CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2025-60710 Microsoft Windows Link Following Vulnerability |
high | 7.8 | Listed | Microsoft / Windows | 2025-11-11 | 2026-10-18 |
| CVE-2025-41244 Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe A... |
high | 7.8 | Listed | Broadcom / VMware Aria Operations and VMware Tools | 2025-09-29 | 2026-10-18 |
| CVE-2025-20362 Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Thre... |
high | 8.6 | Listed | Cisco / Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense | 2025-09-25 | 2026-10-18 |
| CVE-2025-9377 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability |
high | 7.2 | Listed | TP-Link / Multiple Routers | 2025-08-29 | 2026-10-18 |
| CVE-2025-58034 Fortinet FortiWeb OS Command Injection Vulnerability |
high | 7.2 | Listed | Fortinet / FortiWeb | 2025-11-18 | 2026-10-18 |
| CVE-2026-96424 Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2026-82715 Insecure Temporary File vulnerability in Hitachi Disk Array Driver for AIX and H... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73535 Gitea's OpenID connect handler accepts a user's password without enforcing enrol... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73539 Gitea substitutes a URL derived from the markup Context field into external rend... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73800 Gitea resolves local reusable workflow files from a fork's head commit when a tr... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73802 Gitea Runner passes workflow-controlled container options into Docker job contai... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-73804 Gitea allows a token with write:user scope to register an attacker-controlled SS... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-14765 Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecur... |
high | 7.7 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101941 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101942 An Improper Handling of Length Parameter Inconsistency vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101943 An Improper Input Validation vulnerability in the routing protocol daemon (rpd)... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-101940 A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-74037 Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users wit... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63160 Omnispace Agora Project before 26.10.0 contains a vulnerability where the persis... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63165 Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63172 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-111882 phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-18 |
| CVE-2026-111884 phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the cur... |
high | 8.3 | — | — | 2026-10-17 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.