October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,474
Critical
3,283
High
7,907
Medium
7,596
Low
741
Severity not reported
4,947
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1420), google (814), linux (722), ibm (323), oracle (193), mozilla (182), adobe (156), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-69264 pnpm is a package manager. |
critical | 9.8 | — | Pnpm / pnpm | 2026-01-07 | 2026-10-14 |
| CVE-2026-108474 In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped strin... |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-106042 An External Control of File Name or Path vulnerability in Ivanti Xtraction befor... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103848 Adobe Experience Manager is affected by an Improper Neutralization of Special El... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-75732 Adobe Experience Manager is affected by an Incorrect Authorization vulnerability... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-90530 ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restrict... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-85424 MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowin... |
critical | 9.8 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-87855 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrar... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85433 MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD... |
critical | 9.8 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85425 MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in t... |
critical | 9.8 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85427 MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vuln... |
critical | 9.8 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85428 MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in... |
critical | 9.8 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-85430 MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerabili... |
critical | 9.1 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-87684 A stack-based buffer overflow vulnerability exists in the SNMP daemon request ha... |
critical | 9.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-107424 Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashbo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108971 A flaw has been found in D-Link DCS-930L B1.08B4. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109109 A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109157 A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2022-2274 The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for... |
critical | 9.8 | — | Openssl / openssl | 2022-07-01 | 2026-10-14 |
| CVE-2021-46848 GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affe... |
critical | 9.1 | — | Gnu / libtasn1 | 2022-10-24 | 2026-10-14 |
| CVE-2025-53837 XWiki Rendering is a generic rendering system that converts textual input in a g... |
critical | 9.9 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-66455 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
critical | 9.8 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2025-63564 SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allo... |
critical | 9.8 | — | — | 2026-09-23 | 2026-10-14 |
| CVE-2025-41753 The object name of a dynamically created BACnet File Object is interpreted as a... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-14 |
| CVE-2025-71383 Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2025-67896 Exim before 4.99.1, with certain non-default rate-limit configurations, allows a... |
critical | 9.8 | — | Exim / exim | 2025-12-14 | 2026-10-14 |
| CVE-2025-67906 In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS... |
critical | 9.0 | — | Misp-project / misp | 2025-12-15 | 2026-10-14 |
| CVE-2025-59947 NanoMQ is a messaging broker/bus for IoT Edge & SDV. |
critical | 9.0 | — | Emqx / nanomq | 2025-12-15 | 2026-10-14 |
| CVE-2025-13030 All versions of the package django-mdeditor are vulnerable to Missing Authentica... |
critical | 9.8 | — | Pylixm / django-mdeditor | 2026-04-30 | 2026-10-14 |
| CVE-2025-9661 OS command injection vulneravility in the management gui (maintenance utility) o... |
critical | 9.8 | — | Hitachi / virtual storage one block | 2026-05-07 | 2026-10-14 |
| CVE-2026-76268 In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user w... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-14 |
| CVE-2021-35942 The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or... |
critical | 9.1 | — | Gnu / glibc | 2021-07-22 | 2026-10-14 |
| CVE-2021-33574 The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 h... |
critical | 9.8 | — | Gnu / glibc | 2021-05-25 | 2026-10-14 |
| CVE-2021-32292 An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) thro... |
critical | 9.8 | — | Netapp / active iq unified manager | 2023-08-22 | 2026-10-14 |
| CVE-2021-22945 When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some... |
critical | 9.1 | — | Haxx / libcurl | 2021-09-23 | 2026-10-14 |
| CVE-2026-85956 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.6 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85947 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85948 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-85955 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2021-20231 A flaw was found in gnutls. |
critical | 9.8 | — | Gnu / gnutls | 2021-03-12 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.