October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,480
Critical
3,285
High
7,908
Medium
7,598
Low
740
Severity not reported
4,949
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-11401 A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11402 A vulnerability has been found in SourceCodester Hotel and Lodge Management Syst... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11403 A vulnerability was found in SourceCodester Hotel and Lodge Management System 1.... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11404 A vulnerability was determined in SourceCodester Hotel and Lodge Management Syst... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-11405 A vulnerability was identified in SourceCodester Hotel and Lodge Management Syst... |
critical | 9.8 | — | Nikhil-bhalerao / hotel and lodge management system | 2025-10-07 | 2026-10-08 |
| CVE-2025-62650 The Restaurant Brands International (RBI) assistant platform through 2025-09-06... |
critical | 9.9 | — | Rbi / restaurant brands international assistant | 2025-10-17 | 2026-10-08 |
| CVE-2025-11942 A flaw has been found in 70mai X200 up to 20251010. |
critical | 9.8 | — | 70mai / x200 firmware | 2025-10-19 | 2026-10-08 |
| CVE-2025-11943 A vulnerability has been found in 70mai X200 up to 20251010. |
critical | 9.8 | — | 70mai / x200 firmware | 2025-10-19 | 2026-10-08 |
| CVE-2025-55086 In NetXDuo version before 6.4.4, a networking support module for Eclipse Foundat... |
critical | 9.8 | — | Eclipse / threadx netx duo | 2025-10-20 | 2026-10-08 |
| CVE-2025-8053 Insufficient Granularity of Access Control vulnerability in opentext Flipper all... |
critical | 9.1 | — | Opentext / flipper | 2025-10-20 | 2026-10-08 |
| CVE-2026-105110 OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT d... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerabil... |
critical | 9.1 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-9209 mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulne... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-107703 @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-93034 SGLang contains an arbitrary code execution vulnerability caused by the ZMQ mess... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2026-106126 A command injection vulnerability in the Active Directory Events Listener of Ten... |
critical | 9.9 | — | — | 2026-10-08 | 2026-10-08 |
| CVE-2022-36227 In libarchive before 3.6.2, the software does not check for an error after calli... |
critical | 9.8 | — | Libarchive / libarchive | 2022-11-22 | 2026-10-08 |
| CVE-2021-44906 Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, functio... |
critical | 9.8 | — | Substack / minimist | 2022-03-17 | 2026-10-08 |
| CVE-2021-3711 In order to decrypt SM2 encrypted data an application is expected to call the AP... |
critical | 9.8 | — | Openssl / openssl | 2021-08-24 | 2026-10-08 |
| CVE-2021-3331 WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when... |
critical | 9.8 | — | Winscp / winscp | 2021-01-27 | 2026-10-08 |
| CVE-2020-8840 FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JN... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2020-02-10 | 2026-10-08 |
| CVE-2020-27619 In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec test... |
critical | 9.8 | — | Python / python | 2020-10-22 | 2026-10-08 |
| CVE-2019-16942 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-10-01 | 2026-10-08 |
| CVE-2019-17531 A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 th... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-10-12 | 2026-10-08 |
| CVE-2019-16335 A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-09-15 | 2026-10-08 |
| CVE-2019-14892 A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 an... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2020-03-02 | 2026-10-08 |
| CVE-2019-14540 A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-09-15 | 2026-10-08 |
| CVE-2019-14379 SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles de... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-07-29 | 2026-10-08 |
| CVE-2018-14718 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-08 |
| CVE-2018-14719 FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to exec... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-01-02 | 2026-10-08 |
| CVE-2018-11307 An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-07-09 | 2026-10-08 |
| CVE-2018-1000802 Python Software Foundation Python (CPython) version 2.7 contains a CWE-77: Impro... |
critical | 9.8 | — | Python / python | 2018-09-18 | 2026-10-08 |
| CVE-2017-1000158 CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the Py... |
critical | 9.8 | — | Python / python | 2017-11-17 | 2026-10-08 |
| CVE-2016-9063 An integer overflow during the parsing of XML using the Expat library. |
critical | 9.8 | — | Mozilla / firefox | 2018-06-11 | 2026-10-08 |
| CVE-2016-0718 Expat allows context-dependent attackers to cause a denial of service (crash) or... |
critical | 9.8 | — | Mozilla / firefox | 2016-05-26 | 2026-10-08 |
| CVE-2013-7285 Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework h... |
critical | 9.8 | — | Oracle / endeca information discovery studio | 2019-05-15 | 2026-10-08 |
| CVE-2026-62252 Homer is open source telecom observability software. |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107204 LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerab... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107206 LMCache through 0.5.5 contains a missing authentication vulnerability in the mul... |
critical | 9.4 | — | — | 2026-10-07 | 2026-10-08 |
| CVE-2026-107459 The SecuShare Pro developed by Openfind has an OS Command Injection vulnerabilit... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.