October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108860 BotSharp through 5.2.0 contains an authentication bypass vulnerability that allo... |
critical | 9.1 | — | — | 2026-10-11 | 2026-10-16 |
| CVE-2026-110116 Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversa... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110612 vlife through 2.0.1 contains an authentication bypass vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110634 git-diff before 2.0.7 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110639 @mborne/extract before 0.2.1 contains an OS command injection vulnerability that... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110644 nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in c... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110649 Stills before 25.24.2 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110812 Deserialization of untrusted data in the Gremlin graph data import component in... |
critical | 9.9 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-70024 Stack-based buffer overflow in Windows Internet Information Services allows an u... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-110638 doc-recog through 1.1.6 contains an OS command injection vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110643 transcribe2texts through 1.0.6 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-109439 Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 cont... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-85792 Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-49950 Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulner... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110862 Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vu... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-111329 JuggleIM im-server through 1.8.16 ships default administrator credentials admin/... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-92116 OAuth1 callback validation vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92119 REST API Mass Assignment vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-92120 OAuth1 Request Replay Attack vulnerability in Apache Allura. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-89079 The Theme My Login plugin for WordPress is vulnerable to privilege escalation vi... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-85499 Improper Authorization vulnerability in Apache SkyWalking BanyanDB. |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-76284 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-63354 Affected devices do not properly validate and sanitize visual marker data contai... |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-108929 A flaw has been found in Netcore NR268 1.7.121109. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-104798 The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107938 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-net... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-71575 The max_age authentication-freshness check in OidcClientCodeRequestFilter was in... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-69886 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-106612 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-109390 AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrar... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-16 |
| CVE-2026-97816 Use after free in OpenSSH for Windows allows an unauthorized attacker to execute... |
critical | 9.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97814 Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97815 Heap-based buffer overflow in Windows Error Reporting allows an unauthorized att... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-97805 Out-of-bounds read in Windows Partition Management Driver allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-102178 A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107845 Contao is an Open Source CMS. |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78797 An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to exe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-78835 Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficientl... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-96096 Heap-based buffer overflow in Windows Media Player allows an unauthorized attack... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
| CVE-2026-83869 Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized atta... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.