October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,137
Critical
3,250
High
7,757
Medium
7,420
Low
727
Severity not reported
4,983
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-15048 A vulnerability was determined in Tenda WH450 1.0.0.18. |
critical | 9.8 | — | Tenda / wh450 firmware | 2025-12-23 | 2026-10-19 |
| CVE-2025-15049 A vulnerability was identified in code-projects Online Farm System 1.0. |
critical | 9.8 | — | Anisha / online farm system | 2025-12-23 | 2026-10-19 |
| CVE-2025-68665 LangChain is a framework for building LLM-powered applications. |
critical | 9.1 | — | Langchain / langchain.js | 2025-12-23 | 2026-10-19 |
| CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-107083 SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111823 Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon en... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111998 Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112292 CheckCle through 1.6.0 contains a missing authorization vulnerability that allow... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109432 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression i... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111058 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability |
critical | 9.8 | Listed | Linux / Kernel | 2025-09-05 | 2026-10-19 |
| CVE-2026-109383 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109829 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-67231 RabbitMQ is a messaging and streaming broker. |
critical | 9.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-83935 Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-23112 In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp:... |
critical | 9.8 | — | Linux / linux kernel | 2026-02-13 | 2026-10-19 |
| CVE-2026-110372 Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretri... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-104584 reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930c... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 all... |
critical | 9.6 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-66786 A flaw was found in submariner. |
critical | 9.1 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Ligh... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110887 Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-102608 ZoneMinder is a free, open source closed-circuit television software application... |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2025-58068 Eventlet is a concurrent networking library for Python. |
critical | 9.1 | — | Eventlet / eventlet | 2025-08-29 | 2026-10-19 |
| CVE-2025-9772 A vulnerability was detected in RemoteClinic up to 2.0. |
critical | 9.8 | — | Remoteclinic / remote clinic | 2025-09-01 | 2026-10-19 |
| CVE-2025-9775 A vulnerability was found in RemoteClinic up to 2.0. |
critical | 9.8 | — | Remoteclinic / remote clinic | 2025-09-01 | 2026-10-19 |
| CVE-2025-57807 ImageMagick is free and open-source software used for editing and manipulating d... |
critical | 9.8 | — | Imagemagick / imagemagick | 2025-09-05 | 2026-10-19 |
| CVE-2025-58448 rAthena is an open-source cross-platform massively multiplayer online role playi... |
critical | 9.8 | — | Rathena / rathena | 2025-09-09 | 2026-10-19 |
| CVE-2025-58750 rAthena is an open-source cross-platform massively multiplayer online role playi... |
critical | 9.1 | — | Rathena / rathena | 2025-09-09 | 2026-10-19 |
| CVE-2025-10251 A vulnerability was detected in FoxCMS up to 1.24. |
critical | 9.8 | — | Foxcms / foxcms | 2025-09-11 | 2026-10-19 |
| CVE-2025-58045 Dataease is an open source data analytics and visualization platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
| CVE-2025-58046 Dataease is an open-source data visualization and analysis platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
| CVE-2025-58748 Dataease is an open source data analytics and visualization platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.