October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69651 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to de... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-69673 Improper link resolution before file access ('link following') in Windows Update... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69718 Improper neutralization of special elements used in a command ('command injectio... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69596 Use after free in Windows Program Compatibility Assistant Service allows an auth... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69633 Heap-based buffer overflow in Windows Update allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-69452 Use after free in Windows Enterprise App Management allows an authorized attacke... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69454 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69471 Heap-based buffer overflow in Windows Installer allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69521 Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69577 Out-of-bounds read in Microsoft Azure Attestation service and Device Health Atte... |
high | 7.5 | — | Microsoft / windows server 2019 | 2026-10-13 | 2026-10-27 |
| CVE-2026-69326 Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to e... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69354 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69363 Heap-based buffer overflow in Windows Error Reporting allows an authorized attac... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-69370 Improper neutralization of special elements used in a command ('command injectio... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-69387 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-61931 Use after free in Windows Perception Simulation Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-26 |
| CVE-2026-68836 Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-23 |
| CVE-2026-49785 Improper resource shutdown or release in Windows UEFI allows an authorized attac... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-26 |
| CVE-2026-58280 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service o... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-22 |
| CVE-2026-110238 Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerabil... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110247 Several buffer-growth sites in libmime performed size arithmetic in 32-bit types... |
high | 8.4 | — | — | 2026-10-13 | 2026-10-27 |
| CVE-2026-110249 A malicious, compromised, or MITM-controlled Exchange server can return a single... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-110255 Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request... |
high | 8.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-110233 Rovr through 0.10.3 on Windows contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110236 KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerabili... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110237 Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temp... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110220 Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vu... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110211 iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability t... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110215 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110216 youlai-boot through 2.21.1 contains a missing authorization vulnerability that a... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110205 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-26 |
| CVE-2026-110206 Roo Code through 3.54.0 contains a command approval bypass vulnerability in pars... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-16 |
| CVE-2026-110207 Wukong AICRM through 20260610 contains a missing authorization vulnerability tha... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110208 Wukong AICRM through 20260610 contains a missing authorization vulnerability in... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110111 Xen Orchestra before 6.9.0 contains an improper access control vulnerability tha... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-26 |
| CVE-2026-110112 Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110202 Roo Code through 3.54.0 contains a command approval bypass vulnerability in getC... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110203 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-110204 Roo Code through 3.54.0 contains a command approval bypass vulnerability that al... |
high | 8.8 | — | Roocode / roo code | 2026-10-13 | 2026-10-15 |
| CVE-2026-109428 Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.