October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,672
Critical
3,114
High
7,020
Medium
6,795
Low
599
Severity not reported
4,144
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100212 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100209 Use after free in Microsoft Office Excel allows an unauthorized attacker to exec... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-100210 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2025-34291 Langflow Origin Validation Error Vulnerability |
high | 8.8 | Listed | Langflow / Langflow | 2025-12-05 | 2026-10-15 |
| CVE-2026-55381 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55382 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 7.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-55383 InvoiceShelf is an open-source web & mobile app that helps track expenses, payme... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-71490 OPNsense is a FreeBSD based firewall and routing platform. |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111220 pfSense CE through 2.9.0 contains a crontab injection vulnerability in interface... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-102234 Reliance on untrusted inputs in a security decision in Visual Studio Code allows... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102235 Improper encoding or escaping of output in Visual Studio Code allows an unauthor... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-70098 Missing authorization in Visual Studio Code allows an unauthorized attacker to e... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-85888 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78355 A path traversal vulnerability in the OTRS SendSupportBundle functionality allow... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-58249 SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89113 SAP Commerce Cloud does not sufficiently validate certain user-supplied input be... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89120 A regression caused by an API change in SAP ABAP Platform reintroduces a previou... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102073 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions),... |
high | 8.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102074 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions),... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102075 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions),... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-102076 A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions),... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-78557 A vulnerability has been identified in Industrial Edge App Publisher (All versio... |
high | 8.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89196 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89198 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89199 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-89201 A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). |
high | 7.5 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-110455 A malicious actor with access to the network and under certain conditions could... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110459 A malicious actor with access to the network could exploit an Improper Access Co... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100232 Post-authentication Improper Neutralization of Special Elements used in an OS Co... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-96540 An improper access control vulnerability has been identified in the SonicWall Ne... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109237 Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109353 LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unpri... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-109357 LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization a... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-110857 GitPython before 3.2.0 contains a remote code execution vulnerability that allow... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-109363 ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-96577 A flaw was found in oc-mirror. |
high | 7.1 | — | — | 2026-10-01 | 2026-10-15 |
| CVE-2026-85951 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85952 Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85968 Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds r... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85969 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.