October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,478
Critical
3,285
High
7,907
Medium
7,598
Low
740
Severity not reported
4,948
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-66567 Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66568 Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
critical | 9.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2025-48429 An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams func... |
critical | 9.1 | — | Malaterre / grassroots dicom | 2025-12-16 | 2026-10-13 |
| CVE-2025-53618 An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode fu... |
critical | 9.1 | — | Malaterre / grassroots dicom | 2025-12-16 | 2026-10-13 |
| CVE-2025-53619 An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode fu... |
critical | 9.1 | — | Malaterre / grassroots dicom | 2025-12-16 | 2026-10-13 |
| CVE-2025-66647 RIOT is an open-source microcontroller operating system, designed to match the r... |
critical | 9.8 | — | Riot-os / riot | 2025-12-17 | 2026-10-13 |
| CVE-2025-67493 Homarr is an open-source dashboard. |
critical | 9.0 | — | Homarr / homarr | 2025-12-17 | 2026-10-13 |
| CVE-2025-68114 Capstone is a disassembly framework. |
critical | 9.8 | — | Capstone-engine / capstone | 2025-12-17 | 2026-10-13 |
| CVE-2025-68118 FreeRDP is a free implementation of the Remote Desktop Protocol. |
critical | 9.1 | — | Freerdp / freerdp | 2025-12-17 | 2026-10-13 |
| CVE-2025-63386 A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in... |
critical | 9.1 | — | Langgenius / dify | 2025-12-18 | 2026-10-13 |
| CVE-2025-63388 A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in... |
critical | 9.1 | — | Langgenius / dify | 2025-12-18 | 2026-10-13 |
| CVE-2025-58053 Galette is a membership management web application for non profit organizations. |
critical | 9.8 | — | Galette / galette | 2025-12-19 | 2026-10-13 |
| CVE-2025-68668 n8n is an open source workflow automation platform. |
critical | 9.9 | — | N8n / n8n | 2025-12-26 | 2026-10-13 |
| CVE-2025-68932 FreshRSS is a free, self-hostable RSS aggregator. |
critical | 9.8 | — | Freshrss / freshrss | 2025-12-27 | 2026-10-13 |
| CVE-2025-68952 Eigent is a multi-agent Workforce. |
critical | 9.8 | — | Eigent / eigent | 2025-12-27 | 2026-10-13 |
| CVE-2025-68929 Frappe is a full-stack web application framework. |
critical | 9.0 | — | Frappe / frappe | 2025-12-29 | 2026-10-13 |
| CVE-2026-85531 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-86405 Improper verification of cryptographic signature vulnerability in Sipay Electron... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2025-61781 OpenCTI is an open source platform for managing cyber threat intelligence knowle... |
critical | 9.1 | — | Citeum / opencti | 2026-01-05 | 2026-10-12 |
| CVE-2025-71333 Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerab... |
critical | 9.8 | — | Flowiseai / flowise | 2026-06-25 | 2026-10-12 |
| CVE-2025-71338 Flowise through 2.2.7 fails to sanitize path segments in the document-store load... |
critical | 9.8 | — | Flowiseai / flowise | 2026-06-25 | 2026-10-12 |
| CVE-2025-8679 In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized... |
critical | 9.8 | — | Extremenetworks / extremeguest essentials | 2025-10-01 | 2026-10-12 |
| CVE-2025-59681 An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2... |
critical | 9.8 | — | Djangoproject / django | 2025-10-01 | 2026-10-12 |
| CVE-2025-59951 Termix is a web-based server management platform with SSH terminal, tunneling, a... |
critical | 9.1 | — | Termix / termix | 2025-10-01 | 2026-10-12 |
| CVE-2025-59735 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59736 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59737 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59738 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59739 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59740 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59741 Operating system command injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59742 SQL injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-59743 SQL injection vulnerability in AndSoft's e-TMS v25.03. |
critical | 9.8 | — | Andsoft / e-tms | 2025-10-02 | 2026-10-12 |
| CVE-2025-61603 WeGIA is a Web manager for charitable institutions. |
critical | 9.8 | — | Wegia / wegia | 2025-10-02 | 2026-10-12 |
| CVE-2025-61605 WeGIA is an open source web manager with a focus on charitable institutions. |
critical | 9.8 | — | Wegia / wegia | 2025-10-02 | 2026-10-12 |
| CVE-2026-107935 A path traversal vulnerability was found in gvproxy, the network forwarder provi... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-12 |
| CVE-2026-59090 A flaw was found in GIMP's PSD file format plugin. |
critical | 9.9 | — | Gimp / gimp | 2026-08-10 | 2026-10-12 |
| CVE-2025-58668 Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting... |
critical | 9.8 | — | Vibethemes / wordpress learning management system | 2025-09-22 | 2026-10-11 |
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability |
critical | 9.8 | Listed | SolarWinds / Web Help Desk | 2025-09-23 | 2026-10-11 |
| CVE-2025-10812 A vulnerability has been found in code-projects Hostel Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / hostel management system | 2025-09-22 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.