October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,479
Critical
3,285
High
7,907
Medium
7,598
Low
740
Severity not reported
4,949
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-96327 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105697 Langflow is a tool for building and deploying AI-powered agents and workflows. |
critical | 9.9 | — | — | 2026-10-05 | 2026-10-09 |
| CVE-2026-73663 FreePBX is an open source IP PBX. |
critical | 9.8 | — | Sangoma / freepbx | 2026-08-13 | 2026-10-09 |
| CVE-2026-73665 FreePBX is an open source IP PBX. |
critical | 9.8 | — | Sangoma / freepbx | 2026-08-13 | 2026-10-09 |
| CVE-2026-96331 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94503 Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify... |
critical | 10.0 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108109 PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the c... |
critical | 9.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-78663 The HTTP/2 server can refund connection-level flow control twice for the same da... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-108107 PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerabi... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-56857 On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointin... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-96328 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-93947 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-57967 An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH pa... |
critical | 9.8 | — | Apache / artemis | 2026-09-10 | 2026-10-09 |
| CVE-2015-3306 ProFTPD Improper Access Control Vulnerability |
critical | 10.0 | Listed | ProFTPD / ProFTPD | 2015-05-18 | 2026-10-09 |
| CVE-2026-107704 The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injectio... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-83462 Vulnerability in the Oracle Mobile Application Server product of Oracle E-Busine... |
critical | 9.8 | — | Oracle / mobile application server | 2026-09-15 | 2026-10-09 |
| CVE-2021-3199 ONLYOFFICE Docs Server Path Traversal Vulnerability |
critical | 9.8 | Listed | ONLYOFFICE / Docs | 2021-01-26 | 2026-10-09 |
| CVE-2026-76459 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-09 |
| CVE-2026-100833 Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime p... |
critical | 9.6 | — | — | 2026-09-27 | 2026-10-09 |
| CVE-2026-107700 dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-104076 TVU Networks Receiver/Transceiver devices running firmware before version 7.9 co... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2025-61882 Oracle E-Business Suite Unspecified Vulnerability |
critical | 9.8 | Listed | Oracle / E-Business Suite | 2025-10-05 | 2026-10-09 |
| CVE-2025-11032 A flaw has been found in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4e... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-09-26 | 2026-10-09 |
| CVE-2025-11033 A vulnerability has been found in kidaze CourseSelectionSystem up to 42cd892b40a... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-09-26 | 2026-10-09 |
| CVE-2025-11035 A vulnerability was determined in Jinher OA 2.0. |
critical | 9.8 | — | Jinher / jinher oa | 2025-09-26 | 2026-10-09 |
| CVE-2025-11036 A vulnerability was identified in code-projects E-Commerce Website 1.0. |
critical | 9.8 | — | Fabian / e-commerce website | 2025-09-26 | 2026-10-09 |
| CVE-2025-11037 A security flaw has been discovered in code-projects E-Commerce Website 1.0. |
critical | 9.8 | — | Fabian / e-commerce website | 2025-09-26 | 2026-10-09 |
| CVE-2025-11039 A security vulnerability has been detected in Campcodes Computer Sales and Inven... |
critical | 9.8 | — | Campcodes / computer sales and inventory system | 2025-09-26 | 2026-10-09 |
| CVE-2025-11040 A vulnerability was detected in code-projects Hostel Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / hostel management system | 2025-09-26 | 2026-10-09 |
| CVE-2025-11046 A security flaw has been discovered in Tencent WeKnora 0.1.0. |
critical | 9.8 | — | Tencent / weknora | 2025-09-26 | 2026-10-09 |
| CVE-2025-11052 A security flaw has been discovered in kidaze CourseSelectionSystem 1.0/5.php. |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-09-27 | 2026-10-09 |
| CVE-2025-11053 A weakness has been identified in PHPGurukul Small CRM 4.0. |
critical | 9.8 | — | Phpgurukul / small crm | 2025-09-27 | 2026-10-09 |
| CVE-2025-11055 A vulnerability was detected in SourceCodester Online Hotel Reservation System 1... |
critical | 9.8 | — | Fabian / online hotel reservation system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11056 A flaw has been found in ProjectsAndPrograms School Management System 1.0. |
critical | 9.8 | — | Oranbyte / school management system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11057 A vulnerability has been found in SourceCodester Pet Grooming Management Softwar... |
critical | 9.8 | — | Mayurik / pet grooming management software | 2025-09-27 | 2026-10-09 |
| CVE-2025-11061 A vulnerability was found in Campcodes Online Learning Management System 1.0. |
critical | 9.8 | — | Campcodes / online learning management system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11062 A vulnerability was determined in Campcodes Online Learning Management System 1.... |
critical | 9.8 | — | Campcodes / online learning management system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11063 A vulnerability was identified in Campcodes Online Learning Management System 1.... |
critical | 9.8 | — | Campcodes / online learning management system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11064 A security flaw has been discovered in Campcodes Online Learning Management Syst... |
critical | 9.8 | — | Campcodes / online learning management system | 2025-09-27 | 2026-10-09 |
| CVE-2025-11066 A flaw has been found in code-projects Online Bidding System 1.0. |
critical | 9.8 | — | Fabian / online bidding system | 2025-09-27 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.