October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,874
Critical
3,117
High
7,043
Medium
6,889
Low
606
Severity not reported
4,219
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (114), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-87710 Improper access control in Microsoft Local Security Authority Server (lsasrv) al... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87711 Stack-based buffer overflow in Windows Installer allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-87712 Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an au... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85903 Untrusted pointer dereference in DNS Server allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-85827 Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate pr... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-85370 Use after free in WebDAV allows an authorized attacker to elevate privileges loc... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83889 Release of invalid pointer or reference in DNS Server allows an authorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83778 Heap-based buffer overflow in Microsoft Internet Messaging API allows an unautho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-83642 Access of resource using incompatible type ('type confusion') in DNS Server allo... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-15102 ADP Desktop SDK contains a vulnerability where sensitive information is transmit... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-19673 ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the fir... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111451 Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-suppli... |
high | 7.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111114 The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-110444 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110445 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnera... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-109400 The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vul... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107746 The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103895 The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104000 The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103636 Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C+... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-102233 Missing authorization in Visual Studio Code allows an unauthorized attacker to b... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-101994 An Improper Handling of Length Parameter Inconsistency vulnerability in the
l2... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102012 A Reachable Assertion vulnerability in the na-grpcd process of Juniper Networks... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102016 An Improper Validation of Specified Quantity in Input vulnerability in the rpd p... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102064 A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juni... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101939 A NULL Pointer Dereference vulnerability in the routing protocol daemon (RPD) of... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101944 An Integer Overflow or Wraparound vulnerability in the routing protocol daemon (... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101945 An Integer Overflow or Wraparound vulnerability in the rpd process of Juniper Ne... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2013-10076 ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-16 |
| CVE-2026-67407 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-16 |
| CVE-2026-96248 Stack-based buffer overflow in Windows Host Guardian Service allows an unauthori... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-96249 Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker t... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-41510 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-95837 containerd is an open-source container runtime. |
high | 7.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-61642 Squid is a caching proxy for the Web. |
high | 7.7 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108375 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108377 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108378 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108382 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108383 dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.