October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109938 Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109939 FreeRDP 3.27.1 before 3.32.0 contains a NULL pointer dereference in update_read_... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109940 FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stac... |
medium | 4.6 | — | Freerdp / freerdp | 2026-10-13 | 2026-10-26 |
| CVE-2026-109677 FreeRDP from 2.0.0-beta1 before 3.28.0 contains an out-of-bounds read vulnerabil... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-13 | 2026-11-02 |
| CVE-2026-109256 FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_w... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-10-27 |
| CVE-2026-109249 FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in freerdp_assist... |
medium | 5.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109250 FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in col... |
medium | 6.6 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109251 FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origi... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109252 FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerabili... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109253 FreeRDP from 3.9.0 before 3.32.0 contains an out-of-bounds read vulnerability in... |
medium | 5.3 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109254 FreeRDP 2.1.0 before 3.32.0 contains a use-after-free vulnerability in the stati... |
medium | 5.9 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109255 FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in lice... |
medium | 6.8 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109243 FreeRDP from 3.0.0 before 3.32.0 contains an incorrect permission assignment vul... |
medium | 4.4 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109244 FreeRDP from 2.0.0 before 3.32.0 contains an insecure permission vulnerability i... |
medium | 6.6 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109245 FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerab... |
medium | 6.8 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109246 FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-sha... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109248 FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clip... |
medium | 6.5 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109247 FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedes... |
low | 3.1 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-02 |
| CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb... |
low | 3.1 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-03 |
| CVE-2026-109241 FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the c... |
low | 3.1 | — | Freerdp / freerdp | 2026-10-12 | 2026-11-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.