October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,137
Critical
3,250
High
7,757
Medium
7,420
Low
727
Severity not reported
4,983
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109437 Cognition before 0.13.0 contains an unauthenticated remote code execution vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-105312 A Kubernetes tenant with create permission on Console custom resources can set s... |
critical | 9.9 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-64959 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-20 |
| CVE-2026-112776 Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2023-4659 Cross-Site Request Forgery vulnerability, whose exploitation could allow an atta... |
critical | 9.8 | — | Free5gc / webconsole | 2023-10-02 | 2026-10-20 |
| CVE-2026-100202 Use after free in Windows Message Queuing Queue Manager allows an unauthorized a... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100219 Use after free in Microsoft QUIC allows an unauthorized attacker to execute code... |
critical | 9.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-20 |
| CVE-2026-100222 Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-85746 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-85748 MariaDB server is a community developed fork of MySQL server. |
critical | 9.9 | — | Mariadb / mariadb | 2026-10-16 | 2026-10-20 |
| CVE-2026-112779 Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-111862 Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a su... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-20 |
| CVE-2026-77932 DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerabi... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-77933 DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its defau... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-20 |
| CVE-2026-63691 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67273 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67237 RabbitMQ is a messaging and streaming broker. |
critical | 9.3 | — | Broadcom / rabbitmq server | 2026-09-25 | 2026-10-20 |
| CVE-2026-97468 Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated... |
critical | 9.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-111283 BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authenti... |
critical | 9.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2023-6394 A flaw was found in Quarkus. |
critical | 9.1 | — | Quarkus / quarkus | 2023-12-09 | 2026-10-20 |
| CVE-2026-103849 Adobe Commerce is affected by an Improper Neutralization of Special Elements Use... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-20 |
| CVE-2026-47168 EspoCRM is an open source customer relationship management application. |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-110957 A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. |
critical | 10.0 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-104586 AUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Inject... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-77524 KEDA is a Kubernetes-based Event Driven Autoscaling component. |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110631 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Peri... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110636 pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-96252 Improper verification of cryptographic signature in Active Directory Federation... |
critical | 9.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-20 |
| CVE-2026-101307 When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocat... |
critical | 9.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101306 SCM_RIGHTS file descriptor passing did not preserve FD_RESOLVE_BENEATH when a de... |
critical | 9.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-105899 ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vul... |
critical | 10.0 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-20 |
| CVE-2026-99999 In the Linux kernel, the following vulnerability has been resolved:
ipv4: valid... |
critical | 9.3 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2025-9314 The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated a... |
critical | 9.8 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-71429 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2025-14989 A vulnerability was identified in Campcodes Complete Online Beauty Parlor Manage... |
critical | 9.8 | — | Campcodes / complete online beauty parlor management system | 2025-12-21 | 2026-10-19 |
| CVE-2025-14990 A security flaw has been discovered in Campcodes Complete Online Beauty Parlor M... |
critical | 9.8 | — | Campcodes / complete online beauty parlor management system | 2025-12-21 | 2026-10-19 |
| CVE-2025-15008 A vulnerability was detected in Tenda WH450 1.0.0.18. |
critical | 9.8 | — | Tenda / wh450 firmware | 2025-12-22 | 2026-10-19 |
| CVE-2025-15011 A vulnerability was found in code-projects Simple Stock System 1.0. |
critical | 9.8 | — | Carmelo / simple stock system | 2025-12-22 | 2026-10-19 |
| CVE-2025-12049 Missing Authentication for Critical Function vulnerability in Sharp Display Solu... |
critical | 9.8 | — | Sharp / mp-01 firmware | 2025-12-22 | 2026-10-19 |
| CVE-2025-15034 A security flaw has been discovered in itsourcecode Student Management System 1.... |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-23 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.