October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-4911 GNU C Library Buffer Overflow Vulnerability |
high | 7.8 | Listed | GNU / GNU C Library | 2023-10-03 | 2026-10-14 |
| CVE-2026-72923 The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET... |
high | 7.5 | — | — | 2026-09-08 | 2026-10-14 |
| CVE-2025-8110 Gogs Path Traversal Vulnerability |
high | 8.8 | Listed | Gogs / Gogs | 2025-12-10 | 2026-10-14 |
| CVE-2026-84032 IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a m... |
high | 8.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-97830 Double free in Windows Internet Information Services allows an unauthorized atta... |
high | 7.5 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-14 |
| CVE-2026-92883 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1... |
high | 8.7 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-16301 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7... |
high | 8.5 | — | Gitlab / gitlab | 2026-10-13 | 2026-10-14 |
| CVE-2026-110761 ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-52903 A deserialization of untrusted data vulnerability was found in ManageIQ. |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-14507 IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticat... |
high | 7.7 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-88204 Improper neutralization of input during web page generation ('cross-site scripti... |
high | 7.3 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102863 Improper control of generation of code ('code injection') in Microsoft Office Sh... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102862 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102861 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102860 Improper access control in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-105013 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 7.4 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-102866 Improper verification of cryptographic signature in Microsoft Office SharePoint... |
high | 8.1 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70267 Inclusion of functionality from untrusted control sphere in Microsoft Office Sha... |
high | 7.2 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70266 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70251 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70246 Incorrect authorization in Microsoft Office SharePoint allows an authorized atta... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-70202 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88166 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88163 Integer overflow or wraparound in Microsoft Office SharePoint allows an authoriz... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88155 Heap-based buffer overflow in Microsoft Office SharePoint allows an authorized a... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-85900 Deserialization of untrusted data in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88206 Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an auth... |
high | 7.5 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88200 Privilege context switching error in Microsoft Office SharePoint allows an autho... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-88198 Missing authorization in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-14 |
| CVE-2026-14999 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
high | 7.5 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-94585 An authentication bypass vulnerability exists in the web management interface of... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94579 An OS command injection vulnerability exists in the PAM (Pluggable Authenticatio... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94577 A privilege escalation vulnerability exists in the internal Command-Line Interfa... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-94576 An authentication logic and privilege escalation vulnerability exists in the acc... |
high | 8.0 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-87664 A session context forgery vulnerability exists in the web management daemon of B... |
high | 7.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-5048 In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various exter... |
high | 8.0 | — | Broadcom / brocade sannav | 2026-10-08 | 2026-10-14 |
| CVE-2026-92911 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-78193 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-bas... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104345 CAI Content Credentials is affected by an Improper Input Validation vulnerabilit... |
high | 7.5 | — | Adobe / c2pa | 2026-10-13 | 2026-10-14 |
| CVE-2026-104995 The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.