October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,034
Critical
3,238
High
7,713
Medium
7,372
Low
727
Severity not reported
4,984
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (804), linux (709), ibm (323), oracle (187), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112848 Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112847 Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allo... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-112846 Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-61174 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
critical | 9.0 | — | Oracle / product lifecycle analytics | 2026-07-21 | 2026-10-24 |
| CVE-2026-70470 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-70477 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-70478 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 10.0 | — | Flowiseai / flowise | 2026-08-04 | 2026-10-24 |
| CVE-2026-73032 PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a... |
critical | 9.6 | — | — | 2026-08-11 | 2026-10-24 |
| CVE-2026-73487 Flowise before 3.1.3 contains a regex-based Python code validator bypass in CSV... |
critical | 9.8 | — | Flowiseai / flowise | 2026-08-13 | 2026-10-24 |
| CVE-2026-73602 Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScri... |
critical | 9.9 | — | Flowiseai / flowise | 2026-08-13 | 2026-10-24 |
| CVE-2026-99078 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-99079 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98959 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98548 In the Linux kernel, the following vulnerability has been resolved:
sctp: disca... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-24 |
| CVE-2026-98464 In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-24 |
| CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
critical | 9.8 | Listed | JetBrains / TeamCity | 2026-07-27 | 2026-10-24 |
| CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability |
critical | 10.0 | Listed | Arista / VeloCloud Orchestrator | 2026-07-27 | 2026-10-24 |
| CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability |
critical | 9.8 | Listed | Check Point / SmartConsole | 2026-07-22 | 2026-10-24 |
| CVE-2023-23080 Certain Tenda products are vulnerable to command injection. |
critical | 9.8 | — | Tenda / it7-lcs firmware | 2023-02-27 | 2026-10-24 |
| CVE-2023-25207 PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.ph... |
critical | 9.8 | — | Prestashop / dpd france | 2023-03-13 | 2026-10-24 |
| CVE-2023-31039 Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers t... |
critical | 9.8 | — | Apache / brpc | 2023-05-08 | 2026-10-24 |
| CVE-2023-27407 A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). |
critical | 9.9 | — | Siemens / scalance lpe9403 firmware | 2023-05-09 | 2026-10-24 |
| CVE-2023-29129 A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All ve... |
critical | 9.8 | — | Mendix / saml | 2023-06-13 | 2026-10-24 |
| CVE-2023-29531 An attacker could have caused an out of bounds memory access using WebGL APIs, l... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2023-34416 Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2022-44276 In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions r... |
critical | 9.8 | — | Tecrail / responsive filemanager | 2023-06-28 | 2026-10-24 |
| CVE-2021-25827 Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-F... |
critical | 9.8 | — | Emby / emby | 2023-06-28 | 2026-10-24 |
| CVE-2023-34844 Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing t... |
critical | 9.8 | — | Play With Docker Project / play with docker | 2023-06-29 | 2026-10-24 |
| CVE-2023-29131 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). |
critical | 10.0 | — | Siemens / simatic cn 4100 firmware | 2023-07-11 | 2026-10-24 |
| CVE-2026-35035 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-06 | 2026-10-24 |
| CVE-2026-29009 U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readli... |
critical | 9.8 | — | Denx / u-boot | 2026-07-08 | 2026-10-24 |
| CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is rand... |
critical | 9.3 | — | Nlnetlabs / unbound | 2026-07-22 | 2026-10-24 |
| CVE-2026-64815 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible v... |
critical | 9.8 | — | Jetbrains / intellij idea | 2026-07-23 | 2026-10-24 |
| CVE-2026-65906 In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s... |
critical | 10.0 | — | Jetbrains / teamcity | 2026-07-23 | 2026-10-24 |
| CVE-2026-10697 Improper Authentication vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-15966 Permissive cross-domain security policy with untrusted domains vulnerability in... |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-15967 Insufficient session expiration vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att... |
critical | 9.9 | — | Microsoft / azure red hat openshift | 2026-07-24 | 2026-10-24 |
| CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr... |
critical | 9.8 | — | Microsoft / azure dns | 2026-07-24 | 2026-10-24 |
| CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el... |
critical | 9.8 | — | Microsoft / azure key vault | 2026-07-24 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.