October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,452
Critical
3,282
High
7,901
Medium
7,592
Low
741
Severity not reported
4,936
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-57090 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-14 |
| CVE-2023-0687 A vulnerability was found in GNU C Library 2.38. |
critical | 9.8 | — | Gnu / glibc | 2023-02-06 | 2026-10-14 |
| CVE-2025-66567 The ruby-saml library is for implementing the client side of a SAML authorizatio... |
critical | 9.1 | — | Onelogin / ruby-saml | 2025-12-09 | 2026-10-14 |
| CVE-2025-66568 The ruby-saml library implements the client side of an SAML authorization. |
critical | 9.1 | — | Onelogin / ruby-saml | 2025-12-09 | 2026-10-14 |
| CVE-2025-64672 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.0 | — | Microsoft / sharepoint server | 2025-12-09 | 2026-10-14 |
| CVE-2025-14334 A flaw has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14335 A vulnerability has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14336 A vulnerability was found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14337 A vulnerability was determined in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-64113 Emby Server is a user-installable home media server. |
critical | 9.8 | — | Emby / emby | 2025-12-09 | 2026-10-14 |
| CVE-2025-66456 Elysia is a Typescript framework for request validation, type inference, OpenAPI... |
critical | 9.8 | — | Elysiajs / elysia | 2025-12-09 | 2026-10-14 |
| CVE-2025-14087 A flaw was found in GLib (Gnome Lib). |
critical | 9.8 | — | Gnome / glib | 2025-12-10 | 2026-10-14 |
| CVE-2025-34392 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-34393 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-34394 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-14518 A vulnerability was identified in PowerJob up to 5.1.2. |
critical | 9.8 | — | Powerjob / powerjob | 2025-12-11 | 2026-10-14 |
| CVE-2025-65474 An arbitrary file rename vulnerability in the /admin/manager.php component of Ea... |
critical | 9.8 | — | Easyimages2.0 Project / easyimages2.0 | 2025-12-11 | 2026-10-14 |
| CVE-2026-84246 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-75875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-80381 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-81932 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82895 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82900 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to d... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84035 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84057 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84058 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer over... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-70300 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | Nx / Nx Console | 2026-05-27 | 2026-10-14 |
| CVE-2025-64721 Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT... |
critical | 10.0 | — | Sandboxie-plus / sandboxie | 2025-12-11 | 2026-10-14 |
| CVE-2026-8751 A security flaw has been discovered in h2oai h2o-3 up to 7402. |
critical | 9.8 | — | H2o / h2o | 2026-05-17 | 2026-10-14 |
| CVE-2026-8757 A vulnerability was found in adenhq hive up to 0.11.0. |
critical | 9.1 | — | Adenhq / hive | 2026-05-17 | 2026-10-14 |
| CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
critical | 9.8 | — | Microsoft / edge chromium | 2026-05-18 | 2026-10-14 |
| CVE-2026-7876 IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication b... |
critical | 9.1 | — | Ibm / aspera high-speed transfer server for cloud pak for integration | 2026-05-27 | 2026-10-14 |
| CVE-2026-14508 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14888 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14988 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14992 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-97657 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Aut... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-91013 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.