October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,026
Critical
3,238
High
7,710
Medium
7,366
Low
728
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (702), ibm (323), oracle (182), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-34568 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-5663 A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. |
critical | 9.8 | — | Offis / dcmtk | 2026-04-06 | 2026-10-26 |
| CVE-2026-5973 A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. |
critical | 9.1 | — | Vikunja / vikunja | 2026-04-10 | 2026-10-26 |
| CVE-2026-25208 Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow B... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-22619 Eaton Intelligent Power Protector (IPP) is affected by insecure library loading... |
critical | 9.9 | — | Eaton / intelligent power protector | 2026-04-16 | 2026-10-26 |
| CVE-2026-5787 An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7... |
critical | 9.1 | — | Ivanti / endpoint manager mobile | 2026-05-07 | 2026-10-26 |
| CVE-2026-49268 A remote attacker can inject LDAP special characters into the Distinguished Name... |
critical | 9.1 | — | Apache / shiro | 2026-06-17 | 2026-10-26 |
| CVE-2026-55203 HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vul... |
critical | 9.1 | — | Haproxy / haproxy | 2026-06-18 | 2026-10-26 |
| CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability |
critical | 9.8 | Listed | ICagenda / iCagenda | 2026-06-20 | 2026-10-25 |
| CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulne... |
critical | 9.8 | Listed | JoomShaper / SP Page Builder | 2026-06-20 | 2026-10-25 |
| CVE-2026-0643 A flaw has been found in projectworlds House Rental and Property Listing 1.0. |
critical | 9.8 | — | Projectworlds / house rental and property listing project | 2026-01-07 | 2026-10-25 |
| CVE-2026-40088 PraisonAI is a multi-agent teams system. |
critical | 9.6 | — | Praison / praisonai | 2026-04-09 | 2026-10-25 |
| CVE-2026-42238 Nginx UI is a web user interface for the Nginx web server. |
critical | 9.8 | — | Nginxui / nginx ui | 2026-05-04 | 2026-10-25 |
| CVE-2026-42557 jupyterlab is an extensible environment for interactive and reproducible computi... |
critical | 9.6 | — | Jupyter / jupyterlab | 2026-05-13 | 2026-10-25 |
| CVE-2026-8686 Missing bounds validation in the MQTT v5.0 property parser in coreMQTT before 5.... |
critical | 9.1 | — | Freertos / coremqtt | 2026-05-15 | 2026-10-25 |
| CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before... |
critical | 9.8 | — | Zoom / workplace | 2026-06-12 | 2026-10-25 |
| CVE-2026-0126 In WC-Radio, there is a possible out of bounds write due to a missing bounds che... |
critical | 9.8 | — | Google / android | 2026-06-16 | 2026-10-25 |
| CVE-2026-32966 DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metada... |
critical | 9.8 | — | Apache / dolphinscheduler | 2026-06-17 | 2026-10-25 |
| CVE-2026-3894 Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) al... |
critical | 9.1 | — | Rti / connext professional | 2026-06-17 | 2026-10-25 |
| CVE-2026-39999 Authentication Bypass by Spoofing vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-49230 Improper Validation of Integrity Check Value vulnerability in Apache APISIX. |
critical | 9.1 | — | Apache / apisix | 2026-06-19 | 2026-10-25 |
| CVE-2026-12773 A weakness has been identified in BerriAI litellm up to 1.59.8. |
critical | 9.8 | — | Litellm / litellm | 2026-06-21 | 2026-10-25 |
| CVE-2026-6653 Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.... |
critical | 9.8 | — | Xmlsoft / libxml2 | 2026-06-22 | 2026-10-25 |
| CVE-2026-9006 IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side reque... |
critical | 9.1 | — | Ibm / websphere application server | 2026-06-22 | 2026-10-25 |
| CVE-2026-9072 IBM WebSphere Application Server and IBM WebSphere Application Server Liberty -... |
critical | 9.8 | — | Ibm / i | 2026-06-22 | 2026-10-25 |
| CVE-2026-49468 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo... |
critical | 9.8 | — | Litellm / litellm | 2026-06-22 | 2026-10-25 |
| CVE-2026-54305 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2026-06-23 | 2026-10-25 |
| CVE-2026-54307 n8n is an open source workflow automation platform. |
critical | 9.6 | — | N8n / n8n | 2026-06-23 | 2026-10-25 |
| CVE-2026-44726 Deno is a JavaScript, TypeScript, and WebAssembly runtime. |
critical | 9.1 | — | Deno / deno | 2026-06-23 | 2026-10-25 |
| CVE-2026-54316 Claude Code is an agentic coding tool. |
critical | 9.1 | — | Anthropic / claude code | 2026-06-23 | 2026-10-25 |
| CVE-2026-53753 Crawl4AI is an open-source LLM friendly web crawler & scraper. |
critical | 10.0 | — | Kidocode / crawl4ai | 2026-06-23 | 2026-10-25 |
| CVE-2026-55455 Appsmith is a platform to build admin panels, internal tools, and dashboards. |
critical | 9.1 | — | Appsmith / appsmith | 2026-06-24 | 2026-10-25 |
| CVE-2026-8592 OS Command Injection vulnerability in the process_string action of Rapid7 Insigh... |
critical | 9.8 | — | Rapid7 / insightconnect awk | 2026-06-25 | 2026-10-25 |
| CVE-2026-8660 OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect P... |
critical | 9.8 | — | Rapid7 / insightconnect ping | 2026-06-25 | 2026-10-25 |
| CVE-2026-8665 OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Tra... |
critical | 9.8 | — | Rapid7 / insightconnect translate | 2026-06-25 | 2026-10-25 |
| CVE-2026-8666 OS Command Injection vulnerability in the traceroute action of Rapid7 InsightCon... |
critical | 9.8 | — | Rapid7 / insightconnect traceroute | 2026-06-25 | 2026-10-25 |
| CVE-2026-54906 concurrent-ruby is a modern concurrency tools for Ruby. |
critical | 9.8 | — | Rubyconcurrency / concurrent ruby | 2026-06-24 | 2026-10-25 |
| CVE-2026-54030 LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. |
critical | 9.3 | — | Librechat / librechat | 2026-06-25 | 2026-10-25 |
| CVE-2026-48930 A flaw in Node.js TLS hostname handling can cause Embedded-nul hostnames can lea... |
critical | 9.8 | — | Nodejs / node.js | 2026-06-26 | 2026-10-25 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.