October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,479
Critical
3,285
High
7,907
Medium
7,598
Low
740
Severity not reported
4,949
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-10813 A vulnerability was found in code-projects Hostel Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / hostel management system | 2025-09-22 | 2026-10-11 |
| CVE-2025-10816 A security flaw has been discovered in Jinher OA 2.0. |
critical | 9.8 | — | Jinher / jinher oa | 2025-09-22 | 2026-10-11 |
| CVE-2025-10817 A weakness has been identified in Campcodes Online Learning Management System 1.... |
critical | 9.8 | — | Campcodes / online learning management system | 2025-09-22 | 2026-10-11 |
| CVE-2025-10829 A vulnerability was detected in Campcodes Computer Sales and Inventory System 1.... |
critical | 9.8 | — | Campcodes / computer sales and inventory system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10830 A flaw has been found in Campcodes Computer Sales and Inventory System 1.0. |
critical | 9.8 | — | Campcodes / computer sales and inventory system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10831 A vulnerability has been found in Campcodes Computer Sales and Inventory System... |
critical | 9.8 | — | Campcodes / computer sales and inventory system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10832 A vulnerability was found in SourceCodester Pet Grooming Management Software 1.0... |
critical | 9.8 | — | Mayurik / pet grooming management software | 2025-09-23 | 2026-10-11 |
| CVE-2025-10833 A vulnerability was determined in 1000projects Bookstore Management System 1.0. |
critical | 9.8 | — | 1000projects / bookstore management system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10834 A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. |
critical | 9.8 | — | Angeljudesuarez / open source job portal | 2025-09-23 | 2026-10-11 |
| CVE-2025-10836 A weakness has been identified in SourceCodester Pet Grooming Management Softwar... |
critical | 9.8 | — | Mayurik / pet grooming management software | 2025-09-23 | 2026-10-11 |
| CVE-2025-10841 A security vulnerability has been detected in code-projects Online Bidding Syste... |
critical | 9.8 | — | Fabian / online bidding system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10842 A vulnerability was detected in code-projects Online Bidding System 1.0. |
critical | 9.8 | — | Fabian / online bidding system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10843 A flaw has been found in Reservation Online Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / online hotel reservation system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10851 A security flaw has been discovered in Campcodes Gym Management System 1.0. |
critical | 9.8 | — | Campcodes / gym management system | 2025-09-23 | 2026-10-11 |
| CVE-2025-10857 A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. |
critical | 9.8 | — | Campcodes / point of sale system | 2025-09-23 | 2026-10-11 |
| CVE-2025-1255 Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Li... |
critical | 9.1 | — | Rti / connext professional | 2025-09-23 | 2026-10-11 |
| CVE-2025-4993 Untrusted Pointer Dereference vulnerability in RTI Connext Professional (Core Li... |
critical | 9.1 | — | Rti / connext professional | 2025-09-23 | 2026-10-11 |
| CVE-2025-27261 Ericsson Indoor Connect 8855 contains an SQL injection vulnerability which if ex... |
critical | 9.8 | — | Ericsson / indoor connect 8855 firmware | 2025-09-25 | 2026-10-11 |
| CVE-2025-40836 Ericsson Indoor Connect 8855 contains an improper input validation vulnerability... |
critical | 9.8 | — | Ericsson / indoor connect 8855 firmware | 2025-09-25 | 2026-10-11 |
| CVE-2025-11005 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
critical | 9.8 | — | Totolink / x6000r firmware | 2025-09-25 | 2026-10-11 |
| CVE-2026-15340 lwIP SMTP client does not check the size of inputs, potentially allowing a buffe... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105278 The published Docker image for openPDC includes a fixed administrative credentia... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-102628 The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode en... |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-11 |
| CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-s... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96330 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96809 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-84272 IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentic... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-78401 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
critical | 9.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-94510 Authorization bypass through user-controlled key in Microsoft Bookings allows an... |
critical | 9.9 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-82334 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-82335 IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buff... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-82344 IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer ove... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-10 |
| CVE-2026-79842 An authentication bypass vulnerability exists in HPE Intelligent Management Cent... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-78406 IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access... |
critical | 9.8 | — | Ibm / security verify access | 2026-10-08 | 2026-10-10 |
| CVE-2026-77900 Missing authentication for critical function in Azure App Service allows an unau... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-102489 Zammad GmbH Zammad Session Fixation Vulnerability |
critical | 9.8 | Listed | Zammad GmbH / Zammad | 2026-09-30 | 2026-10-10 |
| CVE-2026-62253 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-10 |
| CVE-2026-17609 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-10 |
| CVE-2026-106195 Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.... |
critical | 9.1 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
| CVE-2026-106237 Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.