October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,086
Critical
3,247
High
7,734
Medium
7,398
Low
727
Severity not reported
4,980
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (813), linux (709), ibm (323), oracle (191), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2023-24482 A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3... |
critical | 9.8 | — | Siemens / comos | 2023-02-14 | 2026-10-23 |
| CVE-2023-30191 PrestaShop cdesigner < 3.1.9 is vulnerable to SQL Injection via CdesignerTraitem... |
critical | 9.8 | — | Cdesigner Project / cdesigner | 2023-05-17 | 2026-10-23 |
| CVE-2023-2186 On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticat... |
critical | 9.8 | — | Trianglemicroworks / scada data gateway | 2023-06-07 | 2026-10-23 |
| CVE-2023-29542 A newline in a filename could have been used to bypass the file extension securi... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-23 |
| CVE-2026-34977 Aperi'Solve is an open-source steganalysis web platform. |
critical | 9.8 | — | Aperisolve / aperisolve | 2026-04-06 | 2026-10-23 |
| CVE-2026-34989 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35044 BentoML is a Python library for building online serving systems optimized for AI... |
critical | 9.6 | — | Bentoml / bentoml | 2026-04-06 | 2026-10-23 |
| CVE-2026-35047 Brave CMS is an open-source CMS. |
critical | 9.8 | — | Ajax30 / bravecms | 2026-04-06 | 2026-10-23 |
| CVE-2026-35052 D-Tale is the combination of a Flask back-end and a React front-end to view & an... |
critical | 9.8 | — | Man / d-tale | 2026-04-06 | 2026-10-23 |
| CVE-2026-5734 Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire... |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-5735 Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. |
critical | 9.8 | — | Mozilla / firefox | 2026-04-07 | 2026-10-23 |
| CVE-2026-16184 IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-14974 IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote a... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-14976 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected... |
critical | 9.8 | — | Ibm / websphere application server | 2026-07-28 | 2026-10-23 |
| CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. |
critical | 9.1 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-58177 The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver... |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-23 |
| CVE-2026-65883 Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Ca... |
critical | 9.8 | — | Aimy-extensions / aimy captcha-less form guard | 2026-07-29 | 2026-10-23 |
| CVE-2026-65884 Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-65890 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gri... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.2... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Googl... |
critical | 9.8 | — | Google / mcp toolbox for databases | 2026-07-31 | 2026-10-23 |
| CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query pas... |
critical | 9.0 | — | Pgadmin / pgadmin 4 | 2026-07-31 | 2026-10-23 |
| CVE-2026-21662 Unrestricted upload of file with dangerous type vulnerability in Johnson Control... |
critical | 9.8 | — | Johnsoncontrols / fms employee | 2026-07-31 | 2026-10-23 |
| CVE-2026-66321 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
critical | 9.6 | — | Microsoft / edge chromium | 2026-08-04 | 2026-10-23 |
| CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2025-34522 A heap-based buffer overflow vulnerability exists in the input parsing logic of... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-10-23 |
| CVE-2025-6519 E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY... |
critical | 9.8 | — | Copeland / e3 supervisory controller firmware | 2025-09-02 | 2026-10-23 |
| CVE-2025-40594 A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 H... |
critical | 9.8 | — | Siemens / sinamics g220 firmware | 2025-09-09 | 2026-10-23 |
| CVE-2025-34282 ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulner... |
critical | 9.1 | — | Thingsboard / thingsboard | 2025-10-17 | 2026-10-23 |
| CVE-2025-11366 N-central < 2025.4 is vulnerable to authentication bypass via path traversal |
critical | 9.8 | — | N-able / n-central | 2025-11-12 | 2026-10-23 |
| CVE-2025-11367 The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via... |
critical | 9.8 | — | N-able / n-central | 2025-11-12 | 2026-10-23 |
| CVE-2025-40938 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). |
critical | 9.8 | — | Siemens / simatic cn 4100 firmware | 2025-12-09 | 2026-10-23 |
| CVE-2026-5300 Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unau... |
critical | 9.1 | — | Coolercontrol / coolercontrold | 2026-04-08 | 2026-10-23 |
| CVE-2026-46749 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update... |
critical | 9.8 | — | Siemens / sinec ins | 2026-06-09 | 2026-10-23 |
| CVE-2026-48449 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 9.8 | — | Adobe / campaign | 2026-07-30 | 2026-10-23 |
| CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for... |
critical | 9.8 | — | Php / php | 2026-07-30 | 2026-10-23 |
| CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with s... |
critical | 9.8 | — | Php / php | 2026-07-30 | 2026-10-23 |
| CVE-2026-14522 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.... |
critical | 9.8 | — | Ibm / app connect enterprise | 2026-07-30 | 2026-10-23 |
| CVE-2026-4978 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-07-30 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.