October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-75996 ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability tha... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-76001 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.1 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-71385 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.4 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-65674 Deserialization of untrusted data in SQL Server allows an authorized attacker to... |
high | 8.8 | — | Microsoft / sql server 2019 | 2026-10-13 | 2026-11-02 |
| CVE-2026-67625 Heap-based buffer overflow in SQL Server allows an authorized attacker to execut... |
high | 8.5 | — | Microsoft / sql server 2017 | 2026-10-13 | 2026-11-02 |
| CVE-2026-68883 Heap-based buffer overflow in SQL Server allows an authorized attacker to elevat... |
high | 8.5 | — | Microsoft / sql server 2017 | 2026-10-13 | 2026-11-02 |
| CVE-2026-62840 Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an auth... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-34633 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-34634 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-106618 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-15 |
| CVE-2026-106623 ColdFusion is affected by an Incorrect Authorization vulnerability that could le... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-17 |
| CVE-2026-106089 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106090 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106613 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106614 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 7.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106615 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106616 ColdFusion is affected by an Improper Restriction of XML External Entity Referen... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-106617 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105897 ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability tha... |
high | 8.6 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105898 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.2 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-105900 ColdFusion is affected by an Improper Input Validation vulnerability that could... |
high | 7.5 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105901 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 8.8 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105994 ColdFusion is affected by an Incorrect Authorization vulnerability that could re... |
high | 7.7 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-105443 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insuff... |
high | 8.2 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-105442 IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104346 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-104347 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-104348 Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-103821 Substance3D - Designer is affected by an out-of-bounds write vulnerability that... |
high | 7.8 | — | Adobe / substance 3d designer | 2026-10-13 | 2026-10-15 |
| CVE-2026-101294 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM We... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100111 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-100112 Photoshop Desktop is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | Adobe / photoshop | 2026-10-13 | 2026-10-16 |
| CVE-2026-100127 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100128 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100129 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-86016 VNote is a note-taking platform. |
high | 8.2 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-86022 VNote is a note-taking platform. |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-70098 Missing authorization in Visual Studio Code allows an unauthorized attacker to e... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-63172 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-18 |
| CVE-2026-63174 Omnispace Agora Project before 26.10.0 contains a broken access control vulnerab... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.