October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,874
Critical
3,117
High
7,043
Medium
6,889
Low
606
Severity not reported
4,219
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (114), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108131 No cwe for this issue in Active Directory Federation Services (AD FS) allows an... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105410 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105411 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tule... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-105412 An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could al... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-102176 A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102037 An XML Injection vulnerability in the Unified Threat Management daemon (utmd) of... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102050 A Stack-based Buffer Overflow vulnerability in the l2cpd daemon of Juniper Netwo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102056 An Out-of-bounds Read vulnerability in the cfmd process of Juniper Networks Juno... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102029 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102030 An Incomplete Cleanup vulnerability in the rpd process of Juniper Networks Junos... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102022 A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juni... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102023 A Reachable Assertion vulnerability in fwstatsd of Juniper Networks Junos OS Evo... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102024 An Integer Overflow or Wraparound vulnerability in the routing daemon (rpd) of J... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102025 A Mismatched Memory Management Routines vulnerability in the routing protocol da... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102026 An Improper Control of a Resource Through its Lifetime vulnerability in the rout... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102027 An Incorrect Calculation of Buffer Size vulnerability in the routing protocol da... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102028 A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102020 A Reachable Assertion vulnerability in the rpd process of Juniper Networks Junos... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107837 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107838 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75350 EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107826 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75351 OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side Et... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75352 OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side Eth... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-26244 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-26245 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-44084 An authorization bypass through user-controlled key vulnerability has been repor... |
high | 7.5 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-96244 Use after free in Windows Internal System User Profile allows an authorized atta... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96220 Improper control of generation of code ('code injection') in Windows Assigned Ac... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96223 Use after free in Windows Hyper-V allows an authorized attacker to elevate privi... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96931 Untrusted pointer dereference in Windows NTFS allows an authorized attacker to e... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96932 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96933 Untrusted pointer dereference in Windows COM+ Event System Service allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96323 Use after free in Windows Update allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96324 Use after free in Microsoft Windows Search Component allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96325 Missing reference to active allocated resource in Windows SMB Server allows an u... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96317 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96318 Heap-based buffer overflow in Windows Resume allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.