October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,236
Critical
3,260
High
7,822
Medium
7,473
Low
727
Severity not reported
4,954
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-34203 Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-19 | 2026-10-18 |
| CVE-2025-34204 Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-19 | 2026-10-18 |
| CVE-2025-34205 Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-19 | 2026-10-18 |
| CVE-2025-34206 Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-19 | 2026-10-18 |
| CVE-2025-9588 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
critical | 9.8 | — | Ironmountain / envision | 2025-09-23 | 2026-10-18 |
| CVE-2025-34196 Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34207 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.1049 a... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34212 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34215 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34216 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34218 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34221 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34222 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.1 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34223 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.8 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-34224 Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 22.... |
critical | 9.1 | — | Vasion / virtual appliance application | 2025-09-29 | 2026-10-18 |
| CVE-2025-58587 The application does not implement sufficient measures to prevent multiple faile... |
critical | 9.8 | — | Sick / baggage analytics | 2025-10-06 | 2026-10-18 |
| CVE-2025-36087 IBM Security Verify Access 10.0.0 through 10.0.9, 11.0.0, IBM Verify Identity Ac... |
critical | 9.8 | — | Ibm / security verify access | 2025-10-13 | 2026-10-18 |
| CVE-2025-11719 Starting in Thunderbird 143, the use of the native messaging API by web extensio... |
critical | 9.8 | — | Mozilla / firefox | 2025-10-14 | 2026-10-18 |
| CVE-2025-11721 Memory safety bug present in Firefox 143 and Thunderbird 143. |
critical | 9.8 | — | Mozilla / firefox | 2025-10-14 | 2026-10-18 |
| CVE-2025-49201 A weak authentication vulnerability in Fortinet FortiPAM 1.5.0, FortiPAM 1.4.0 t... |
critical | 9.8 | — | Fortinet / fortipam | 2025-10-14 | 2026-10-18 |
| CVE-2025-20359 Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Deco... |
critical | 9.1 | — | Cisco / snort | 2025-10-15 | 2026-10-18 |
| CVE-2025-11832 Allocation of Resources Without Limits or Throttling vulnerability in Azure Acce... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-15 | 2026-10-18 |
| CVE-2025-6542 An arbitrary OS command may be executed on the product by a remote unauthenticat... |
critical | 9.8 | — | Tp-link / er8411 firmware | 2025-10-21 | 2026-10-18 |
| CVE-2025-7851 An attacker may obtain the root shell on the underlying OS system with the restr... |
critical | 9.8 | — | Tp-link / fr307-m2 firmware | 2025-10-21 | 2026-10-18 |
| CVE-2025-12104 Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.T... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-23 | 2026-10-18 |
| CVE-2025-12176 Undocumented administrative accounts were getting created to facilitate access f... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-24 | 2026-10-18 |
| CVE-2025-12217 SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.... |
critical | 9.1 | — | Azure-access / blu-ic2 firmware | 2025-10-25 | 2026-10-18 |
| CVE-2025-12218 Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: th... |
critical | 9.1 | — | Azure-access / blu-ic2 firmware | 2025-10-25 | 2026-10-18 |
| CVE-2025-12219 Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.1... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-25 | 2026-10-18 |
| CVE-2025-12220 Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: thro... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-25 | 2026-10-18 |
| CVE-2025-12275 Mail Configuration File Manipulation + Command Execution.This issue affects BLU-... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-26 | 2026-10-18 |
| CVE-2025-12285 Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-26 | 2026-10-18 |
| CVE-2025-12364 Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: throug... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-27 | 2026-10-18 |
| CVE-2025-12422 Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super us... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-28 | 2026-10-18 |
| CVE-2025-12424 Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-28 | 2026-10-18 |
| CVE-2025-64095 DNN (formerly DotNetNuke) is an open-source web content management platform (CMS... |
critical | 9.8 | — | Dnnsoftware / dotnetnuke | 2025-10-28 | 2026-10-18 |
| CVE-2025-12476 Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: thro... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-29 | 2026-10-18 |
| CVE-2025-12477 Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: t... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-29 | 2026-10-18 |
| CVE-2025-12478 Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-29 | 2026-10-18 |
| CVE-2025-12552 Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-31 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.