October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-95680 IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attac... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-93907 IBM WebSphere Application Server 8.5, and 9.0 could allow a remote attacker to b... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-77910 Incorrect authorization in Microsoft Exchange Server allows an authorized attack... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70571 Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70175 Improper authentication in ASP.NET Core allows an unauthorized attacker to eleva... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-70183 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53418 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for An... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-53420 Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an u... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-18513 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18529 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18537 IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and... |
high | 8.7 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109778 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109756 Privilege escalation in the DOM: Navigation component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103418 Firefox for iOS directly interpolated the page’s HTML language attribute into tr... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102226 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-102869 Access of resource using incompatible type ('type confusion') in .NET and Visual... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100214 Deserialization of untrusted data in Dynamics Business Central allows an authori... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-84837 A flaw was found in rpm. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-84838 A flaw was found in rpmuncompress. |
high | 7.8 | — | — | 2026-09-02 | 2026-10-14 |
| CVE-2026-108623 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108628 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108522 A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. |
high | 8.3 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107914 Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently prot... |
high | 7.8 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108108 PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-75349 EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bound... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-107782 System Informer before 4.0.26241.138 contains an incorrect authorization vulnera... |
high | 7.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107723 fast-jwt provides fast JSON Web Token (JWT) implementation. |
high | 8.1 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107728 Strawberry GraphQL is a library for creating GraphQL APIs. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107377 datamodel-code-generator generates Python data models from schema definitions. |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-107383 MariaDB Connector/Node.js is used to connect applications developed on Node.js t... |
high | 7.5 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-97801 Improper validation of specified type of input in .NET Framework allows an unaut... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70186 Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70181 Allocation of resources without limits or throttling in ASP.NET Core allows an u... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69454 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69370 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108398 Untrusted search path in .NET Framework allows an authorized attacker to bypass... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108400 Integer overflow or wraparound in Microsoft Windows Codecs Library allows an una... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105728 Improper authentication in Dynamics Business Central allows an unauthorized atta... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.