October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-40311 In the Linux kernel, the following vulnerability has been resolved:
accel/haban... |
not reported | — | — | — | 2025-12-08 | 2026-10-30 |
| CVE-2025-40160 In the Linux kernel, the following vulnerability has been resolved:
xen/events:... |
not reported | — | — | — | 2025-11-12 | 2026-10-30 |
| CVE-2025-40180 In the Linux kernel, the following vulnerability has been resolved:
mailbox: zy... |
not reported | — | — | — | 2025-11-12 | 2026-10-30 |
| CVE-2025-40268 In the Linux kernel, the following vulnerability has been resolved:
cifs: clien... |
not reported | — | — | — | 2025-12-06 | 2026-10-30 |
| CVE-2025-40289 In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu:... |
not reported | — | — | — | 2025-12-06 | 2026-10-30 |
| CVE-2025-40071 In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm:... |
not reported | — | — | — | 2025-10-28 | 2026-10-30 |
| CVE-2025-40077 In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix t... |
not reported | — | — | — | 2025-10-28 | 2026-10-30 |
| CVE-2025-40136 In the Linux kernel, the following vulnerability has been resolved:
crypto: his... |
not reported | — | — | — | 2025-11-12 | 2026-10-30 |
| CVE-2025-40137 In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix t... |
not reported | — | — | — | 2025-11-12 | 2026-10-30 |
| CVE-2025-40003 In the Linux kernel, the following vulnerability has been resolved:
net: mscc:... |
not reported | — | — | — | 2025-10-18 | 2026-10-30 |
| CVE-2025-40057 In the Linux kernel, the following vulnerability has been resolved:
ptp: Add a... |
not reported | — | — | — | 2025-10-28 | 2026-10-30 |
| CVE-2025-40065 In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM... |
not reported | — | — | — | 2025-10-28 | 2026-10-30 |
| CVE-2023-53750 In the Linux kernel, the following vulnerability has been resolved:
pinctrl: fr... |
not reported | — | — | — | 2025-12-08 | 2026-10-30 |
| CVE-2023-54013 In the Linux kernel, the following vulnerability has been resolved:
interconnec... |
not reported | — | — | — | 2025-12-24 | 2026-10-30 |
| CVE-2026-112192 MISP contains a vulnerability in the handling of module plugin settings. |
not reported | — | — | — | 2026-10-19 | 2026-10-30 |
| CVE-2026-21157 Improper input validation in Bixby prior to version 4.0.85.6 allows privileged l... |
not reported | — | — | — | 2026-10-29 | 2026-10-30 |
| CVE-2026-112211 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61654 Lightdash is an open source business intelligence platform. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-61673 WeGIA is a web manager for charitable institutions. |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-72813 actix-files before 0.6.10 contains a denial of service vulnerability triggered b... |
not reported | — | — | — | 2026-08-14 | 2026-10-29 |
| CVE-2026-72814 The actix-files crate (actix_files) before version 0.6.10 contains an informatio... |
not reported | — | — | — | 2026-08-14 | 2026-10-29 |
| CVE-2026-73051 actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerabilit... |
not reported | — | — | — | 2026-08-14 | 2026-10-29 |
| CVE-2026-22185 OpenLDAP Lightning Memory-Mapped Database (LMDB) versions 0.9.14 before 0.9.34,... |
not reported | — | — | — | 2026-01-07 | 2026-10-29 |
| CVE-2026-118245 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118249 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118253 Highcharts JS is a JavaScript charting library based on SVG. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118261 Echo is a Go web framework. |
not reported | — | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-105206 ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authori... |
not reported | — | — | — | 2026-10-04 | 2026-10-29 |
| CVE-2025-34023 A path traversal vulnerability exists in the Karel IP1211 IP Phone's web managem... |
not reported | — | — | — | 2025-06-20 | 2026-10-29 |
| CVE-2025-34108 A stack-based buffer overflow vulnerability exists in the login functionality of... |
not reported | — | — | — | 2025-07-15 | 2026-10-29 |
| CVE-2025-34457 wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit... |
not reported | — | — | — | 2025-12-22 | 2026-10-29 |
| CVE-2025-34458 wb2osz/direwolf (Dire Wolf) versions up to and including 1.8.1, prior to commit... |
not reported | — | — | — | 2025-12-22 | 2026-10-29 |
| CVE-2025-25034 A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24... |
not reported | — | — | — | 2025-06-20 | 2026-10-29 |
| CVE-2024-58296 CE Phoenix v1.0.8.20 contains a stored cross-site scripting vulnerability in the... |
not reported | — | — | — | 2025-12-11 | 2026-10-29 |
| CVE-2024-58300 Siklu MultiHaul TG series devices through version 2.0.0 contain an unauthenticat... |
not reported | — | — | — | 2025-12-11 | 2026-10-29 |
| CVE-2026-67203 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-67205 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering... |
not reported | — | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116161 Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an informat... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-116165 Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing a... |
not reported | — | — | — | 2026-10-25 | 2026-10-29 |
| CVE-2026-70387 Exposed dangerous method or function and Incorrect Authorization vulnerability i... |
not reported | — | — | — | 2026-10-21 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.