October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,337
Critical
3,273
High
7,854
Medium
7,530
Low
728
Severity not reported
4,952
In CISA KEV
190
Most affected vendors (by CPE data where available): microsoft (1401), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Te... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66262 Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Tel... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66022 FACTION is a PenTesting Report Generation and Collaboration Framework. |
critical | 9.8 | — | Owasp / faction | 2025-11-26 | 2026-10-18 |
| CVE-2025-13797 A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13798 A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13799 A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13800 A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2026-73251 Mongoose is an embedded web server and network library. |
critical | 9.1 | — | Cesanta / mongoose | 2026-08-20 | 2026-10-18 |
| CVE-2026-73253 Mongoose is an embedded web server and network library. |
critical | 9.1 | — | Cesanta / mongoose | 2026-08-20 | 2026-10-18 |
| CVE-2026-77638 Tor before 0.4.9.11 is prone to a race condition where in just the right circums... |
critical | 9.0 | — | Torproject / tor | 2026-08-20 | 2026-10-18 |
| CVE-2026-62834 Improper verification of cryptographic signature in Azure Data Factory allows an... |
critical | 9.8 | — | Microsoft / azure data factory | 2026-08-20 | 2026-10-18 |
| CVE-2026-77642 tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus... |
critical | 9.3 | — | Torproject / tor | 2026-08-20 | 2026-10-18 |
| CVE-2025-66034 fontTools is a library for manipulating fonts, written in Python. |
critical | 9.8 | — | Fonttools / fonttools | 2025-11-29 | 2026-10-18 |
| CVE-2025-13783 A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44ee... |
critical | 9.8 | — | Wtcms Project / wtcms | 2025-11-30 | 2026-10-18 |
| CVE-2025-13786 A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2... |
critical | 9.8 | — | Wtcms Project / wtcms | 2025-11-30 | 2026-10-18 |
| CVE-2025-13787 A flaw has been found in ZenTao up to 21.7.6-8564. |
critical | 9.1 | — | Zentao / zentao | 2025-11-30 | 2026-10-18 |
| CVE-2025-13788 A vulnerability has been found in Chanjet CRM up to 20251106. |
critical | 9.8 | — | Chanjet / chanjet crm | 2025-11-30 | 2026-10-18 |
| CVE-2025-66405 Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. |
critical | 9.8 | — | Portkey / gateway | 2025-12-01 | 2026-10-18 |
| CVE-2025-66410 Gin-vue-admin is a backstage management system based on vue and gin. |
critical | 9.1 | — | Gin-vue-admin Project / gin-vue-admin | 2025-12-01 | 2026-10-18 |
| CVE-2025-66409 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
critical | 9.1 | — | Espressif / esp-idf | 2025-12-02 | 2026-10-18 |
| CVE-2025-66489 Cal.com is open-source scheduling software. |
critical | 9.8 | — | Cal / cal.com | 2025-12-03 | 2026-10-18 |
| CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability |
critical | 10.0 | Listed | Meta / React Server Components | 2025-12-03 | 2026-10-18 |
| CVE-2025-13390 The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass... |
critical | 9.8 | — | Wpdirectorykit / wp directory kit | 2025-12-03 | 2026-10-18 |
| CVE-2025-64443 MCP Gateway allows easy and secure running and deployment of MCP servers. |
critical | 9.6 | — | Docker / mcp gateway | 2025-12-03 | 2026-10-18 |
| CVE-2025-66222 DeepChat is a smart assistant uses artificial intelligence. |
critical | 9.6 | — | Thinkinai / deepchat | 2025-12-03 | 2026-10-18 |
| CVE-2025-64081 SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester P... |
critical | 9.8 | — | Pamzey / patients waiting area queue management system | 2025-12-08 | 2026-10-18 |
| CVE-2025-14015 A weakness has been identified in H3C Magic B0 up to 100R002. |
critical | 9.8 | — | H3c / magic b0 firmware | 2025-12-04 | 2026-10-18 |
| CVE-2025-66576 Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system command... |
critical | 9.8 | — | Remotecontrolio / remote keyboard desktop | 2025-12-04 | 2026-10-18 |
| CVE-2025-66509 LaraDashboard is an all-In-one solution to start a Laravel Application. |
critical | 9.8 | — | Laradashboard / lara dashboard | 2025-12-04 | 2026-10-18 |
| CVE-2026-18516 An output escaping vulnerability in the Audit Logs component of Crafty Controlle... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2025-14093 A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. |
critical | 9.8 | — | Edimax / br-6478ac v3 firmware | 2025-12-05 | 2026-10-18 |
| CVE-2025-14094 A flaw has been found in Edimax BR-6478AC V3 1.0.15. |
critical | 9.8 | — | Edimax / br-6478ac v3 firmware | 2025-12-05 | 2026-10-18 |
| CVE-2026-109321 Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth... |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108707 Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2025-12515 Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: t... |
critical | 9.8 | — | Azure-access / blu-ic4 firmware | 2025-10-30 | 2026-10-18 |
| CVE-2025-12516 Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: thro... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-30 | 2026-10-18 |
| CVE-2012-10063 Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in th... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-18 |
| CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability |
critical | 9.8 | Listed | BeyondTrust / Remote Support | 2026-10-15 | 2026-10-17 |
| CVE-2026-101950 A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.