October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110759 Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-110753 Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-108709 Authentication bypass within in-house network in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-75994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-102210 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-20 |
| CVE-2026-79608 The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to bet... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-68573 Improper Authentication vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-107460 Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-64610 Deserialization of Untrusted Data vulnerability in Apache Kylin. |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-63619 Missing Authorization vulnerability in Apache Kylin. |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-64959 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2023-4659 Cross-Site Request Forgery vulnerability, whose exploitation could allow an atta... |
critical | 9.8 | — | Free5gc / webconsole | 2023-10-02 | 2026-10-20 |
| CVE-2026-100202 Use after free in Windows Message Queuing Queue Manager allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100222 Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-85748 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-112779 Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111862 Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a su... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-77932 DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77933 DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-63691 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67273 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67237 RabbitMQ is a messaging and streaming broker. |
critical | 9.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-111283 BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authenti... |
critical | 9.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2023-6394 A flaw was found in Quarkus. |
critical | 9.1 | — | Quarkus / quarkus | 2023-12-09 | 2026-10-20 |
| CVE-2026-103849 Adobe Commerce is affected by an Improper Neutralization of Special Elements Use... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-47168 EspoCRM is an open source customer relationship management application. |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-110957 A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Inject... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-77524 KEDA is a Kubernetes-based Event Driven Autoscaling component. |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110631 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Peri... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110636 pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-96252 Improper verification of cryptographic signature in Active Directory Federation... |
critical | 9.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocat... |
critical | 9.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a de... |
critical | 9.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-105899 ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vul... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved:
ipv4: valid... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.