October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,337
Critical
3,273
High
7,854
Medium
7,530
Low
728
Severity not reported
4,952
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-34328 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and inclu... |
critical | 9.8 | — | Audiocodes / fax server | 2025-11-19 | 2026-10-18 |
| CVE-2025-34329 AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and inclu... |
critical | 9.8 | — | Audiocodes / fax server | 2025-11-19 | 2026-10-18 |
| CVE-2025-13315 Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw... |
critical | 9.8 | — | Lynxtechnology / twonky server | 2025-11-19 | 2026-10-18 |
| CVE-2025-65025 esm.sh is a nobuild content delivery network(CDN) for modern web development. |
critical | 9.8 | — | Esm / esm.sh | 2025-11-19 | 2026-10-18 |
| CVE-2025-65026 esm.sh is a nobuild content delivery network(CDN) for modern web development. |
critical | 9.6 | — | Esm / esm.sh | 2025-11-19 | 2026-10-18 |
| CVE-2025-65099 Claude Code is an agentic coding tool. |
critical | 9.8 | — | Anthropic / claude code | 2025-11-19 | 2026-10-18 |
| CVE-2025-13410 A vulnerability has been found in Campcodes Retro Basketball Shoes Online Store... |
critical | 9.8 | — | Campcodes / retro basketball shoes online store | 2025-11-19 | 2026-10-18 |
| CVE-2025-13411 A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. |
critical | 9.8 | — | Campcodes / retro basketball shoes online store | 2025-11-19 | 2026-10-18 |
| CVE-2025-13420 A weakness has been identified in itsourcecode Human Resource Management System... |
critical | 9.8 | — | Angeljudesuarez / human resource management system | 2025-11-19 | 2026-10-18 |
| CVE-2025-13421 A security vulnerability has been detected in itsourcecode Human Resource Manage... |
critical | 9.8 | — | Angeljudesuarez / human resource management system | 2025-11-19 | 2026-10-18 |
| CVE-2025-13422 A vulnerability was detected in freeprojectscodes Sports Club Management System... |
critical | 9.8 | — | Darkseid / sports club management system | 2025-11-20 | 2026-10-18 |
| CVE-2025-13424 A vulnerability has been found in Campcodes Supplier Management System 1.0. |
critical | 9.8 | — | Campcodes / supplier management system | 2025-11-20 | 2026-10-18 |
| CVE-2025-13442 A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. |
critical | 9.8 | — | Utt / 750w firmware | 2025-11-20 | 2026-10-18 |
| CVE-2025-13445 A flaw has been found in Tenda AC21 16.03.08.16. |
critical | 9.8 | — | Tenda / ac21 firmware | 2025-11-20 | 2026-10-18 |
| CVE-2025-13446 A vulnerability has been found in Tenda AC21 16.03.08.16. |
critical | 9.8 | — | Tenda / ac21 firmware | 2025-11-20 | 2026-10-18 |
| CVE-2025-13449 A vulnerability was found in code-projects Online Shop Project 1.0. |
critical | 9.8 | — | Oretnom23 / online shop project | 2025-11-20 | 2026-10-18 |
| CVE-2025-13451 A vulnerability was identified in SourceCodester Online Shop Project 1.0. |
critical | 9.8 | — | Oretnom23 / online shop project | 2025-11-20 | 2026-10-18 |
| CVE-2025-40604 Download of Code Without Integrity Check Vulnerability in the SonicWall Email Se... |
critical | 9.8 | — | Sonicwall / email security appliance 5000 firmware | 2025-11-20 | 2026-10-18 |
| CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure monitor | 2025-11-20 | 2026-10-18 |
| CVE-2025-64655 Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an... |
critical | 9.8 | — | Microsoft / dynamics omnichannel sdk storage containers | 2025-11-20 | 2026-10-18 |
| CVE-2025-64755 Claude Code is an agentic coding tool. |
critical | 9.8 | — | Anthropic / claude code | 2025-11-21 | 2026-10-18 |
| CVE-2025-41115 SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in Apri... |
critical | 9.8 | — | Grafana / grafana | 2025-11-21 | 2026-10-18 |
| CVE-2025-13544 A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc... |
critical | 9.8 | — | Ashraf-kabir / travel-agency | 2025-11-23 | 2026-10-18 |
| CVE-2025-13546 A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5f... |
critical | 9.8 | — | Ashraf-kabir / travel-agency | 2025-11-23 | 2026-10-18 |
| CVE-2025-13554 A security vulnerability has been detected in Campcodes Supplier Management Syst... |
critical | 9.8 | — | Campcodes / supplier management system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13555 A vulnerability was detected in Campcodes School File Management System 1.0. |
critical | 9.8 | — | Campcodes / school file management system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13556 A flaw has been found in Campcodes Online Polling System 1.0. |
critical | 9.8 | — | Campcodes / online polling system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13557 A vulnerability has been found in Campcodes Online Polling System 1.0. |
critical | 9.8 | — | Campcodes / online polling system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13560 A vulnerability was found in SourceCodester Company Website CMS 1.0. |
critical | 9.8 | — | Torrahclef / company website cms | 2025-11-23 | 2026-10-18 |
| CVE-2025-65084 An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon,... |
critical | 9.8 | — | Ashlar / argon | 2025-11-25 | 2026-10-18 |
| CVE-2025-65085 A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, X... |
critical | 9.8 | — | Ashlar / argon | 2025-11-25 | 2026-10-18 |
| CVE-2025-64656 Out-of-bounds read in Application Gateway allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / azure application gateway | 2025-11-26 | 2026-10-18 |
| CVE-2025-66250 Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Te... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66251 Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Te... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telec... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66254 Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66255 Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica T... |
critical | 9.8 | — | Dbbroadcast / mozart next 3000 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Tel... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66257 Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica T... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66259 Authenticated Root Remote Code Execution via improrer user input filtering in DB... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.