October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,137
Critical
3,250
High
7,757
Medium
7,420
Low
727
Severity not reported
4,983
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (709), ibm (323), oracle (193), mozilla (182), adobe (155), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-10662 A vulnerability has been found in SeaCMS up to 13.3. |
critical | 9.8 | — | Seacms / seacms | 2025-09-18 | 2026-10-19 |
| CVE-2026-109894 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110886 Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational F... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2025-59431 MapServer is a system for developing web-based GIS applications. |
critical | 9.8 | — | Osgeo / mapserver | 2025-09-19 | 2026-10-19 |
| CVE-2025-9642 An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b... |
critical | 9.6 | — | Gitlab / gitlab | 2025-09-26 | 2026-10-19 |
| CVE-2025-54592 FreshRSS is a free, self-hostable RSS aggregator. |
critical | 9.8 | — | Freshrss / freshrss | 2025-09-29 | 2026-10-19 |
| CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. |
critical | 9.9 | — | Redis / redis | 2025-10-03 | 2026-10-19 |
| CVE-2025-59944 Cursor is a code editor built for programming with AI. |
critical | 9.8 | — | Anysphere / cursor | 2025-10-03 | 2026-10-19 |
| CVE-2025-11344 A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11345 A flaw has been found in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11346 A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11529 A security flaw has been discovered in ChurchCRM up to 5.18.0. |
critical | 9.8 | — | Churchcrm / churchcrm | 2025-10-09 | 2026-10-19 |
| CVE-2025-11624 Potential stack buffer overwrite on the SFTP server side when receiving a malici... |
critical | 9.8 | — | Wolfssh / wolfssh | 2025-10-21 | 2026-10-19 |
| CVE-2025-11625 Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier... |
critical | 9.8 | — | Wolfssh / wolfssh | 2025-10-21 | 2026-10-19 |
| CVE-2025-62717 Emlog is an open source website building system. |
critical | 9.1 | — | Emlog / emlog | 2025-10-24 | 2026-10-19 |
| CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability wher... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110653 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
critical | 9.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104736 The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in ver... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-84015 Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-111690 Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-69883 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2025-12480 Gladinet Triofox Improper Access Control Vulnerability |
critical | 9.1 | Listed | Gladinet / Triofox | 2025-11-10 | 2026-10-19 |
| CVE-2025-12268 A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdab... |
critical | 9.8 | — | Learnhouse / learnhouse | 2025-10-27 | 2026-10-19 |
| CVE-2025-64102 Zitadel is open-source identity infrastructure software. |
critical | 9.8 | — | Zitadel / zitadel | 2025-10-29 | 2026-10-19 |
| CVE-2025-64103 Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor aut... |
critical | 9.8 | — | Zitadel / zitadel | 2025-10-29 | 2026-10-19 |
| CVE-2025-11200 MLflow Weak Password Requirements Authentication Bypass Vulnerability. |
critical | 9.8 | — | Lfprojects / mlflow | 2025-10-29 | 2026-10-19 |
| CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution... |
critical | 9.8 | — | Lfprojects / mlflow | 2025-10-29 | 2026-10-19 |
| CVE-2025-12642 lighttpd1.4.80 incorrectly merged trailer fields into headers after http request... |
critical | 9.1 | — | Lighttpd / lighttpd | 2025-11-03 | 2026-10-19 |
| CVE-2025-47776 Mantis Bug Tracker (MantisBT) is an open source issue tracker. |
critical | 9.1 | — | Mantisbt / mantisbt | 2025-11-04 | 2026-10-19 |
| CVE-2025-62161 Youki is a container runtime written in Rust. |
critical | 10.0 | — | Youki-dev / youki | 2025-11-06 | 2026-10-19 |
| CVE-2025-62596 Youki is a container runtime written in Rust. |
critical | 10.0 | — | Youki-dev / youki | 2025-11-06 | 2026-10-19 |
| CVE-2025-64163 DataEase is an open source data visualization analysis tool. |
critical | 9.8 | — | Dataease / dataease | 2025-11-06 | 2026-10-19 |
| CVE-2025-64164 Dataease is an open source data visualization analysis tool. |
critical | 9.8 | — | Dataease / dataease | 2025-11-06 | 2026-10-19 |
| CVE-2025-64717 ZITADEL is an open source identity management platform. |
critical | 9.8 | — | Zitadel / zitadel | 2025-11-13 | 2026-10-19 |
| CVE-2025-13168 A weakness has been identified in ury-erp ury up to 0.2.0. |
critical | 9.8 | — | Ury / ury | 2025-11-14 | 2026-10-19 |
| CVE-2025-64428 Dataease is an open source data visualization analysis tool. |
critical | 9.8 | — | Dataease / dataease | 2025-11-20 | 2026-10-19 |
| CVE-2025-30201 Wazuh is a free and open source platform used for threat prevention, detection,... |
critical | 9.1 | — | Wazuh / wazuh | 2025-11-21 | 2026-10-19 |
| CVE-2025-66205 Frappe is a full-stack web application framework. |
critical | 9.8 | — | Frappe / frappe | 2025-12-01 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.