October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,480
Critical
3,285
High
7,908
Medium
7,598
Low
740
Severity not reported
4,949
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-55100 In USBX before 6.4.3, the USB support module for Eclipse Foundation ThreadX, the... |
critical | 9.1 | — | Eclipse / threadx usbx | 2025-10-17 | 2026-10-09 |
| CVE-2025-11111 A weakness has been identified in Campcodes Advanced Online Voting Management Sy... |
critical | 9.8 | — | Campcodes / advanced online voting system | 2025-09-28 | 2026-10-09 |
| CVE-2025-11115 A vulnerability has been found in code-projects Simple Scheduling System 1.0. |
critical | 9.8 | — | Fabian / simple scheduling system | 2025-09-28 | 2026-10-09 |
| CVE-2025-11116 A vulnerability was found in code-projects Simple Scheduling System 1.0. |
critical | 9.8 | — | Fabian / simple scheduling system | 2025-09-28 | 2026-10-09 |
| CVE-2025-11118 A vulnerability was identified in CodeAstro Student Grading System 1.0. |
critical | 9.8 | — | Codeastro / student grading system | 2025-09-28 | 2026-10-09 |
| CVE-2025-11139 A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. |
critical | 9.8 | — | Zhiyou-group / zhiyou erp | 2025-09-29 | 2026-10-09 |
| CVE-2025-11140 A vulnerability was identified in Bjskzy Zhiyou ERP up to 11.0. |
critical | 9.8 | — | Zhiyou-group / zhiyou erp | 2025-09-29 | 2026-10-09 |
| CVE-2025-48006 Improper restriction of XML external entity reference issue exists in DataSpider... |
critical | 9.1 | — | Saison / dataspider servista | 2025-09-29 | 2026-10-09 |
| CVE-2025-35032 Medical Informatics Engineering Enterprise Health allows authenticated users to... |
critical | 9.9 | — | Mieweb / enterprise health | 2025-09-29 | 2026-10-09 |
| CVE-2025-59937 go-mail is a comprehensive library for sending mails with Go. |
critical | 9.1 | — | Pebcak / go-mail | 2025-09-29 | 2026-10-09 |
| CVE-2026-107510 An authenticated high privilege user can inject arguments in troubleshooting com... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-09 |
| CVE-2026-63692 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
critical | 10.0 | — | Dell / container storage modules | 2026-10-06 | 2026-10-09 |
| CVE-2026-104070 The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulner... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2023-51714 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x be... |
critical | 9.8 | — | Debian / debian linux | 2023-12-24 | 2026-10-08 |
| CVE-2023-26119 Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.... |
critical | 9.8 | — | Htmlunit / htmlunit | 2023-04-03 | 2026-10-08 |
| CVE-2022-32511 jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation w... |
critical | 9.8 | — | Jmespath / jmespath | 2022-06-06 | 2026-10-08 |
| CVE-2021-29921 In Python before 3,9,5, the ipaddress library mishandles leading zero characters... |
critical | 9.8 | — | Python / python | 2021-05-06 | 2026-10-08 |
| CVE-2021-23450 All versions of package dojo are vulnerable to Prototype Pollution via the setOb... |
critical | 9.8 | — | Linuxfoundation / dojo | 2021-12-17 | 2026-10-08 |
| CVE-2021-23369 The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE... |
critical | 9.8 | — | Handlebarsjs / handlebars | 2021-04-12 | 2026-10-08 |
| CVE-2021-23383 The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when s... |
critical | 9.8 | — | Handlebarsjs / handlebars | 2021-05-04 | 2026-10-08 |
| CVE-2020-7788 This affects the package ini before 1.3.6. |
critical | 9.8 | — | Ini Project / ini | 2020-12-11 | 2026-10-08 |
| CVE-2020-6072 An exploitable code execution vulnerability exists in the label-parsing function... |
critical | 9.8 | — | Videolabs / libmicrodns | 2020-03-24 | 2026-10-08 |
| CVE-2019-20444 HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a... |
critical | 9.1 | — | Netty / netty | 2020-01-29 | 2026-10-08 |
| CVE-2019-20445 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to... |
critical | 9.1 | — | Netty / netty | 2020-01-29 | 2026-10-08 |
| CVE-2019-13962 lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player t... |
critical | 9.8 | — | Videolan / vlc media player | 2019-07-18 | 2026-10-08 |
| CVE-2019-14893 A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.1... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2020-03-02 | 2026-10-08 |
| CVE-2018-1270 Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 a... |
critical | 9.8 | — | Vmware / spring framework | 2018-04-06 | 2026-10-08 |
| CVE-2018-1115 postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension,... |
critical | 9.1 | — | Postgresql / postgresql | 2018-05-10 | 2026-10-08 |
| CVE-2017-7525 A deserialization flaw was discovered in the jackson-databind, versions before 2... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2018-02-06 | 2026-10-08 |
| CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket... |
critical | 9.8 | — | Apache / log4j | 2017-04-17 | 2026-10-08 |
| CVE-2016-9841 inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecif... |
critical | 9.8 | — | Zlib / zlib | 2017-05-23 | 2026-10-08 |
| CVE-2017-15095 A deserialization flaw was discovered in the jackson-databind in versions before... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2018-02-06 | 2026-10-08 |
| CVE-2016-5018 In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.... |
critical | 9.1 | — | Apache / tomcat | 2017-08-10 | 2026-10-08 |
| CVE-2025-61932 Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communicati... |
critical | 9.8 | Listed | Motex / LANSCOPE Endpoint Manager | 2025-10-20 | 2026-10-08 |
| CVE-2025-59943 phpMyFAQ is an open source FAQ web application. |
critical | 9.8 | — | Phpmyfaq / phpmyfaq | 2025-10-03 | 2026-10-08 |
| CVE-2025-11354 A flaw has been found in code-projects Online Hotel Reservation System 1.0. |
critical | 9.8 | — | Fabian / online hotel reservation system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11396 A vulnerability was identified in code-projects Simple Food Ordering System 1.0. |
critical | 9.8 | — | Fabian / simple food ordering system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11397 A security flaw has been discovered in SourceCodester Hotel and Lodge Management... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11399 A security vulnerability has been detected in SourceCodester Hotel and Lodge Man... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11400 A vulnerability was detected in SourceCodester Hotel and Lodge Management System... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.