October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-78524 Out-of-bounds write in Microsoft Office allows an unauthorized attacker to execu... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-73013 Heap-based buffer overflow in Windows Imaging Component allows an unauthorized a... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-71328 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / visual studio 2022 | 2026-09-08 | 2026-10-30 |
| CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-23 | 2026-10-30 |
| CVE-2026-69806 Exposure of sensitive information to an unauthorized actor in .NET allows an aut... |
high | 7.0 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-69767 Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69610 Buffer over-read in Windows Win32K allows an authorized attacker to elevate priv... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69576 Use after free in Graphic Fonts allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69556 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-69522 Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to e... |
high | 8.8 | — | — | 2026-09-08 | 2026-10-30 |
| CVE-2026-69499 Integer overflow or wraparound in Windows Imaging Component allows an unauthoriz... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-69439 Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / .net | 2026-09-08 | 2026-10-30 |
| CVE-2026-68880 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-10-30 |
| CVE-2026-62804 External control of file name or path in Microsoft Office Word allows an unautho... |
high | 7.8 | — | Microsoft / 365 apps | 2026-09-08 | 2026-10-30 |
| CVE-2026-107161 A heap-based buffer overflow flaw was found in Cyrus SASL. |
high | 7.5 | — | — | 2026-10-07 | 2026-10-30 |
| CVE-2026-62966 ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32... |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-57201 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-57200 Asterisk is an open source private branch exchange and telephony toolkit. |
high | 7.5 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-116672 Authlib is a Python library which builds OAuth and OpenID Connect servers. |
high | 8.8 | — | — | 2026-10-27 | 2026-10-30 |
| CVE-2026-76288 In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unau... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-76290 In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthentica... |
high | 7.5 | — | Splunk / splunk | 2026-10-21 | 2026-10-30 |
| CVE-2026-88081 Out-of-bounds read in SQL Server allows an authorized attacker to disclose infor... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-30 |
| CVE-2026-87346 Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (com... |
high | 8.7 | — | — | 2026-10-20 | 2026-10-30 |
| CVE-2026-86948 This issue was addressed by enforcing library validation on the affected binarie... |
high | 8.8 | — | Apple / xcode | 2026-10-20 | 2026-10-30 |
| CVE-2026-79882 There is a command injection vulnerability in the PAPI protocol of AOS-10 that c... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79883 A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 co... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79884 A vulnerability in the web-based management interface of AOS-8 could allow an un... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79877 A remote code execution vulnerability in the underlying operating system of AOS-... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79878 A command injection vulnerability in the AOS-8 command line interface accessed b... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79879 Memory corruption vulnerabilities in the affected interface of AOS-10 could lead... |
high | 8.8 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79880 A vulnerability in the command line interface of AOS-8 could allow an authentica... |
high | 8.7 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-79881 An authentication bypass vulnerability in the underlying operating system of AOS... |
high | 8.3 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-62331 praktor is a multi-agent Claude Code orchestrator with Telegram input and output... |
high | 8.2 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59387 The Nginx routing configuration for Cloud Controller blocks unauthenticated acce... |
high | 8.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-59978 AdminNeo is a full-featured database management tool written in PHP. |
high | 7.5 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119337 RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. |
high | 7.1 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-119116 A use-after-free and double-free issue in the SetClient command handler of the k... |
high | 7.8 | — | — | 2026-10-30 | 2026-10-30 |
| CVE-2026-115419 The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 a... |
high | 8.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114510 Flexible GraphRAG is a Python framework for building graph and retrieval-augment... |
high | 7.1 | — | — | 2026-10-22 | 2026-10-30 |
| CVE-2026-114622 baserCMS is a website development framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-30 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.