October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,672
Critical
3,114
High
7,020
Medium
6,795
Low
599
Severity not reported
4,144
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85970 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-75939 A flaw was found in openshift/oc-mirror. |
high | 7.4 | — | — | 2026-09-21 | 2026-10-15 |
| CVE-2026-65149 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-65150 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-65147 NVIDIA DALI contains a vulnerability where an attacker could cause an uncontroll... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109757 Sandbox escape due to race condition in the Networking component. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109730 Integer overflow in the Graphics component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109733 JIT miscompilation in the JavaScript Engine: JIT component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-109753 Incorrect boundary conditions in the Layout component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108184 Improper certificate validation in certain Zoom Clients for Windows may allow an... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-108185 Improper certificate validation in the My Notes feature of certain Zoom Clients... |
high | 7.4 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-67223 RabbitMQ is a messaging and streaming broker. |
high | 7.1 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-15 |
| CVE-2026-96611 FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. |
high | 7.8 | — | Ffmpeg / ffmpeg | 2026-09-23 | 2026-10-15 |
| CVE-2026-30754 A memory corruption vulnerability exists in FFmpeg before 8.1. |
high | 8.8 | — | Ffmpeg / ffmpeg | 2026-09-08 | 2026-10-15 |
| CVE-2026-92151 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92154 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-85959 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85961 On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85962 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85964 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85965 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.0 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85966 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85975 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85953 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 8.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85958 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-79838 A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79839 A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory c... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79840 A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corrupt... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19577 net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's lin... |
high | 7.1 | — | — | 2026-10-11 | 2026-10-15 |
| CVE-2026-110767 Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_que... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line us... |
high | 7.8 | — | Openbsd / openssh | 2026-10-07 | 2026-10-15 |
| CVE-2026-105407 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105408 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-105409 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Ed... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-103929 mise manages dev tools like node, python, cmake, and terraform. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103412 Improper limitation of a pathname to a restricted directory ('path traversal') v... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-103413 Improper input validation vulnerability in Apache Camel Karavan. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-19627 IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitr... |
high | 8.2 | — | Ibm / planning analytics | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.