October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,026
Critical
3,238
High
7,710
Medium
7,366
Low
728
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (702), ibm (323), oracle (182), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-58025 Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWik... |
critical | 9.8 | — | Mediawiki / mediawiki | 2026-07-01 | 2026-10-25 |
| CVE-2026-58453 JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h... |
critical | 9.8 | — | — | 2026-07-01 | 2026-10-25 |
| CVE-2026-9074 IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains... |
critical | 9.8 | — | Ibm / api connect | 2026-07-08 | 2026-10-25 |
| CVE-2026-8649 Improper Neutralization of Special Elements in Data Query Logic vulnerability in... |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-08 | 2026-10-25 |
| CVE-2026-54527 JupyterLab Git is a Git extension for JupyterLab. |
critical | 9.0 | — | Jupyter / jupyterlab-git | 2026-07-08 | 2026-10-25 |
| CVE-2026-55471 HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i... |
critical | 9.1 | — | Hapifhir / hl7 fhir core | 2026-07-08 | 2026-10-25 |
| CVE-2026-47826 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at... |
critical | 9.1 | — | Cloudfoundry / bosh cli | 2026-07-09 | 2026-10-25 |
| CVE-2026-58459 gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injecti... |
critical | 9.6 | — | Gpsd Project / gpsd | 2026-07-09 | 2026-10-25 |
| CVE-2026-58521 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | Mediawiki / cargo | 2026-07-01 | 2026-10-25 |
| CVE-2026-14363 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | Mediawiki / cargo | 2026-07-01 | 2026-10-25 |
| CVE-2026-12481 A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe... |
critical | 9.8 | — | Keras / keras | 2026-07-03 | 2026-10-25 |
| CVE-2026-57983 Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized... |
critical | 10.0 | — | Microsoft / edge chromium | 2026-07-03 | 2026-10-25 |
| CVE-2026-14535 In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImports... |
critical | 9.8 | — | Trailofbits / fickling | 2026-07-04 | 2026-10-25 |
| CVE-2026-57211 RabbitMQ is a messaging and streaming broker. |
critical | 10.0 | — | Broadcom / rabbitmq server | 2026-07-10 | 2026-10-25 |
| CVE-2026-57216 RabbitMQ is a messaging and streaming broker. |
critical | 10.0 | — | Broadcom / rabbitmq server | 2026-07-10 | 2026-10-25 |
| CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles compone... |
critical | 9.8 | — | Rsjoomla / rsfiles\! | 2026-07-11 | 2026-10-25 |
| CVE-2026-56372 ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the... |
critical | 9.1 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-25 |
| CVE-2026-59792 In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path trav... |
critical | 9.8 | — | Jetbrains / intellij idea | 2026-07-10 | 2026-10-24 |
| CVE-2026-10666 parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for string... |
critical | 9.8 | — | Zephyrproject / zephyr | 2026-07-12 | 2026-10-24 |
| CVE-2026-57830 Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in H... |
critical | 9.1 | — | Ollyo / helix ultimate | 2026-07-13 | 2026-10-24 |
| CVE-2026-40468 Integer overflow vulnerability has been found in "builtin.c" program file of gaw... |
critical | 9.1 | — | Fossies / gawk | 2026-07-13 | 2026-10-24 |
| CVE-2026-40469 Integer overflow vulnerability has been found in "builtin.c" program file of gaw... |
critical | 9.1 | — | Fossies / gawk | 2026-07-13 | 2026-10-24 |
| CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo... |
critical | 9.1 | — | Perl / perl | 2026-07-13 | 2026-10-24 |
| CVE-2026-46633 Twig is a template language for PHP. |
critical | 9.8 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-46634 Twig is a template language for PHP. |
critical | 9.8 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48805 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48806 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48807 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
critical | 10.0 | Listed | SonicWall / SMA1000 Appliances | 2026-07-14 | 2026-10-24 |
| CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr... |
critical | 9.1 | — | Apache / doris | 2026-07-14 | 2026-10-24 |
| CVE-2026-62422 In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-07-14 | 2026-10-24 |
| CVE-2026-62390 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2026-62392 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2026-10672 subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI... |
critical | 9.1 | — | Zephyrproject / zephyr | 2026-07-14 | 2026-10-24 |
| CVE-2026-59836 A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3... |
critical | 9.8 | — | Fortinet / forticlientems | 2026-07-14 | 2026-10-24 |
| CVE-2026-62643 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascadin... |
critical | 10.0 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-62644 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin o... |
critical | 9.8 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-54058 Pillow is a Python imaging library. |
critical | 9.1 | — | Python / pillow | 2026-07-14 | 2026-10-24 |
| CVE-2026-54433 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross... |
critical | 10.0 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-58617 Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized... |
critical | 9.8 | — | Microsoft / 365 copilot | 2026-07-14 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.