October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,452
Critical
3,282
High
7,901
Medium
7,592
Low
741
Severity not reported
4,936
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2022-48522 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that... |
critical | 9.8 | — | Perl / perl | 2023-08-22 | 2026-10-14 |
| CVE-2025-43936 Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Au... |
critical | 9.1 | — | Dell / objectscale | 2026-09-16 | 2026-10-14 |
| CVE-2025-59953 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2025-15002 A vulnerability has been found in SeaCMS up to 13.3. |
critical | 9.8 | — | Seacms / seacms | 2025-12-21 | 2026-10-14 |
| CVE-2025-59389 An SQL injection vulnerability has been reported to affect Hyper Data Protector. |
critical | 9.8 | — | Qnap / hyper data protector | 2026-01-02 | 2026-10-14 |
| CVE-2025-65110 Vega is a visualization grammar, a declarative format for creating, saving, and... |
critical | 9.3 | — | Vega Project / vega | 2026-01-05 | 2026-10-14 |
| CVE-2025-68705 RustFS is a distributed object storage system built in Rust. |
critical | 9.8 | — | Rustfs / rustfs | 2026-01-07 | 2026-10-14 |
| CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joom... |
critical | 9.8 | — | Ordasoft / joomla cck | 2026-10-05 | 2026-10-14 |
| CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and... |
critical | 9.8 | — | Techfry / tf content | 2026-10-05 | 2026-10-14 |
| CVE-2026-106358 Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-83711 Authorization bypass through user-controlled key in Microsoft Azure Active Direc... |
critical | 10.0 | — | Microsoft / azure active directory b2c | 2026-09-03 | 2026-10-14 |
| CVE-2026-70352 Missing authentication for critical function in Azure AI Language allows an unau... |
critical | 10.0 | — | Microsoft / azure ai language authoring | 2026-09-03 | 2026-10-14 |
| CVE-2026-93388 The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnera... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108894 A security flaw has been discovered in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2022-37434 zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in infl... |
critical | 9.8 | — | Zlib / zlib | 2022-08-05 | 2026-10-14 |
| CVE-2022-37454 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove... |
critical | 9.8 | — | Extended Keccak Code Package Project / extended keccak code package | 2022-10-21 | 2026-10-14 |
| CVE-2025-15399 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
critical | 10.0 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-56590 HCL BigFix Service Management is affected by an Unrestricted File Upload vulnera... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-56592 HCL BigFix Service Management is affected by an Improper Authentication validati... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-21806 HCL BigFix Service Management is affected by an Administrative Session Concurren... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-83662 Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110130 Dockhand before 1.0.45 contains an authentication bypass in which the global aut... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107779 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2025-12543 A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo... |
critical | 9.6 | — | Redhat / build of apache camel | 2026-01-07 | 2026-10-14 |
| CVE-2022-32207 When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes... |
critical | 9.8 | — | Haxx / curl | 2022-07-07 | 2026-10-14 |
| CVE-2022-32221 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`... |
critical | 9.8 | — | Haxx / curl | 2022-12-05 | 2026-10-14 |
| CVE-2022-29155 In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerabil... |
critical | 9.8 | — | Openldap / openldap | 2022-05-04 | 2026-10-14 |
| CVE-2022-28321 The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentica... |
critical | 9.8 | — | Linux-pam / linux-pam | 2022-09-19 | 2026-10-14 |
| CVE-2022-25236 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-16 | 2026-10-14 |
| CVE-2022-25315 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-18 | 2026-10-14 |
| CVE-2025-62718 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.9 | — | Axios / axios | 2026-04-09 | 2026-10-14 |
| CVE-2022-25235 xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-16 | 2026-10-14 |
| CVE-2022-23852 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-01-24 | 2026-10-14 |
| CVE-2022-23218 The deprecated compatibility function svcunix_create in the sunrpc module of the... |
critical | 9.8 | — | Gnu / glibc | 2022-01-14 | 2026-10-14 |
| CVE-2022-23219 The deprecated compatibility function clnt_create in the sunrpc module of the GN... |
critical | 9.8 | — | Gnu / glibc | 2022-01-14 | 2026-10-14 |
| CVE-2022-22822 addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ove... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-01-10 | 2026-10-14 |
| CVE-2022-22823 build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer ov... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-01-10 | 2026-10-14 |
| CVE-2022-22824 defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an intege... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-01-10 | 2026-10-14 |
| CVE-2026-107594 The File Upload to Order WordPress plugin before 1.1.4 does not validate or conf... |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2025-69264 pnpm is a package manager. |
critical | 9.8 | — | Pnpm / pnpm | 2026-01-07 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.