October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,651
Critical
3,234
High
7,687
Medium
7,337
Low
703
Severity not reported
4,690
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1426), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-36346 Improper input validation in AMD Power Management Firmware (PMFW) could allow a... |
medium | 6.0 | — | — | 2025-09-06 | 2026-10-27 |
| CVE-2024-45431 OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. |
medium | 5.3 | — | Opensynergy / blue sdk | 2025-09-12 | 2026-10-27 |
| CVE-2024-5200 The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of i... |
medium | 4.8 | — | — | 2025-09-29 | 2026-10-27 |
| CVE-2024-44632 PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id... |
medium | 6.5 | — | Phpgurukul / student record system | 2025-11-14 | 2026-10-27 |
| CVE-2024-44635 PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS... |
medium | 6.1 | — | Phpgurukul / student record system | 2025-11-14 | 2026-10-27 |
| CVE-2024-44636 PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adm... |
medium | 6.5 | — | Phpgurukul / student record system | 2025-11-14 | 2026-10-27 |
| CVE-2024-44639 PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub... |
medium | 6.5 | — | Phpgurukul / student record system | 2025-11-14 | 2026-10-27 |
| CVE-2024-55016 PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection... |
medium | 6.5 | — | Phpgurukul / student record system | 2025-11-14 | 2026-10-27 |
| CVE-2024-44647 PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the are... |
medium | 6.1 | — | Phpgurukul / small crm | 2025-11-17 | 2026-10-27 |
| CVE-2024-44648 PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection via id and adminremark p... |
medium | 6.5 | — | Phpgurukul / small crm | 2025-11-17 | 2026-10-27 |
| CVE-2024-44652 Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_emai... |
medium | 6.5 | — | Kashipara / ecommerce website | 2025-11-17 | 2026-10-27 |
| CVE-2024-46334 kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XS... |
medium | 6.1 | — | Kashipara / school management system | 2025-11-17 | 2026-10-27 |
| CVE-2024-46336 kashipara School Management System 1.0 is vulnerable to Cross Site Scripting (XS... |
medium | 6.1 | — | Kashipara / school management system | 2025-11-17 | 2026-10-27 |
| CVE-2024-44653 Kashipara Ecommerce Website 1.0 is vulnerable to SQL Injection via the user_emai... |
medium | 6.5 | — | Kashipara / ecommerce website | 2025-11-17 | 2026-10-27 |
| CVE-2024-44662 PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the use... |
medium | 6.5 | — | Phpgurukul / online shopping portal | 2025-11-17 | 2026-10-27 |
| CVE-2024-2105 An unauthorised attacker within bluetooth range may use an improper validation d... |
medium | 6.5 | — | — | 2025-12-10 | 2026-10-27 |
| CVE-2024-58289 Microweber 2.0.15 contains a stored cross-site scripting vulnerability that allo... |
medium | 5.4 | — | Microweber / microweber | 2025-12-11 | 2026-10-27 |
| CVE-2024-58297 PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin... |
medium | 5.4 | — | Pyrocms / pyrocms | 2025-12-11 | 2026-10-27 |
| CVE-2024-58304 SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability i... |
medium | 6.1 | — | — | 2025-12-11 | 2026-10-27 |
| CVE-2024-29370 In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attac... |
medium | 5.3 | — | Python-jose Project / python-jose | 2025-12-17 | 2026-10-27 |
| CVE-2024-25814 MyNET up to v26.05 was discovered to contain a reflected cross-site scripting (X... |
medium | 6.1 | — | Airc / mynet | 2025-12-22 | 2026-10-27 |
| CVE-2024-35321 MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting (X... |
medium | 4.3 | — | Airc / mynet | 2025-12-22 | 2026-10-27 |
| CVE-2024-35322 MyNET up to v26.08 was discovered to contain a reflected cross-site scripting (X... |
medium | 6.1 | — | Airc / mynet | 2025-12-24 | 2026-10-27 |
| CVE-2024-39037 MyNET up to v26.08.316 was discovered to contain an Unauthenticated SQL Injectio... |
medium | 6.5 | — | Airc / mynet | 2025-12-24 | 2026-10-27 |
| CVE-2024-29720 An issue in Terra Informatica Software, Inc Sciter v.4.4.7.0 allows a local atta... |
medium | 5.5 | — | Terrainformatica / sciter | 2025-12-26 | 2026-10-27 |
| CVE-2024-42718 A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to re... |
medium | 6.5 | — | Croogo / croogo | 2025-12-26 | 2026-10-27 |
| CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-S... |
medium | 6.1 | — | — | 2026-05-01 | 2026-10-27 |
| CVE-2024-28765 IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0... |
medium | 5.3 | — | Ibm / security directory integrator | 2026-05-27 | 2026-10-27 |
| CVE-2024-24709 Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly... |
medium | 4.3 | — | — | 2026-06-17 | 2026-10-27 |
| CVE-2024-58360 stoatchat versions before 0.7.8 fail to enforce account creation restrictions in... |
medium | 6.5 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-32385 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 all... |
medium | 4.3 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-32387 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 all... |
medium | 5.7 | — | — | 2026-07-16 | 2026-10-27 |
| CVE-2024-58356 SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DE... |
medium | 6.3 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58357 SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in t... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58358 SurrealDB versions before 2.1.0 contain a denial of service vulnerability in rol... |
medium | 4.9 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58359 SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58361 SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerabi... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58364 SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerabi... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58365 SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in t... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
| CVE-2024-58367 SurrealDB versions before 2.0.4 fail to properly enforce field permissions durin... |
medium | 6.5 | — | Surrealdb / surrealdb | 2026-07-18 | 2026-10-27 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.