October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-40315 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | Praison / praisonai | 2026-04-14 | 2026-10-26 |
| CVE-2026-27246 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing... |
critical | 9.1 | — | Fastify / fastify\/express | 2026-04-15 | 2026-10-26 |
| CVE-2026-6290 Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plu... |
critical | 9.1 | — | Rapid7 / velociraptor | 2026-04-15 | 2026-10-26 |
| CVE-2026-41153 In JetBrains Junie before 252.549.29 command execution was possible via maliciou... |
critical | 9.8 | — | Jetbrains / junie | 2026-04-17 | 2026-10-26 |
| CVE-2026-32311 Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri... |
critical | 9.8 | — | Flowsint / flowsint | 2026-04-20 | 2026-10-26 |
| CVE-2026-39861 Claude Code is an agentic coding tool. |
critical | 10.0 | — | Anthropic / claude code | 2026-04-21 | 2026-10-26 |
| CVE-2026-41304 WWBN AVideo is an open source video platform. |
critical | 9.8 | — | Wwbn / avideo | 2026-04-22 | 2026-10-26 |
| CVE-2026-5935 IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TS... |
critical | 9.8 | — | Ibm / total storage service console | 2026-04-23 | 2026-10-26 |
| CVE-2026-3960 A critical remote code execution vulnerability exists in the unauthenticated RES... |
critical | 9.8 | — | H2o / h2o | 2026-04-23 | 2026-10-26 |
| CVE-2026-25874 LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as... |
critical | 9.8 | — | Huggingface / lerobot | 2026-04-23 | 2026-10-26 |
| CVE-2026-41265 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41268 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41276 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-25660 CodeChecker is an analyzer tooling, defect database and viewer extension for the... |
critical | 9.8 | — | Ericsson / codechecker | 2026-04-24 | 2026-10-26 |
| CVE-2026-7036 A vulnerability was identified in Tenda i9 1.0.0.5(2204). |
critical | 9.8 | — | Tenda / i9 firmware | 2026-04-26 | 2026-10-26 |
| CVE-2026-40514 SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness i... |
critical | 9.1 | — | Smartertools / smartermail | 2026-04-27 | 2026-10-26 |
| CVE-2026-33845 A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero len... |
critical | 9.1 | — | Gnu / gnutls | 2026-04-30 | 2026-10-26 |
| CVE-2026-33446 CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Sec... |
critical | 9.8 | — | Absolute / secure access | 2026-04-30 | 2026-10-26 |
| CVE-2026-42010 A flaw was found in gnutls. |
critical | 9.8 | — | Gnu / gnutls | 2026-05-07 | 2026-10-26 |
| CVE-2026-91622 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
critical | 9.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiSandbox | 2026-04-14 | 2026-10-26 |
| CVE-2025-67066 SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker... |
critical | 9.8 | — | — | 2026-09-04 | 2026-10-26 |
| CVE-2025-55787 In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerabili... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-26 |
| CVE-2025-70516 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70520 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-0546 A vulnerability was determined in code-projects Content Management System 1.0. |
critical | 9.8 | — | Code-projects / content management system | 2026-01-02 | 2026-10-26 |
| CVE-2026-0585 A security vulnerability has been detected in code-projects Online Product Reser... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0590 A vulnerability was determined in code-projects Online Product Reservation Syste... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0591 A vulnerability was identified in code-projects Online Product Reservation Syste... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0592 A security flaw has been discovered in code-projects Online Product Reservation... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0597 A flaw has been found in Campcodes Supplier Management System 1.0. |
critical | 9.8 | — | Campcodes / supplier management system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0605 A security vulnerability has been detected in code-projects Online Music Site 1.... |
critical | 9.8 | — | Fabian / online music site | 2026-01-05 | 2026-10-26 |
| CVE-2026-0606 A vulnerability was detected in code-projects Online Music Site 1.0. |
critical | 9.8 | — | Fabian / online music site | 2026-01-05 | 2026-10-26 |
| CVE-2026-0607 A flaw has been found in code-projects Online Music Site 1.0. |
critical | 9.8 | — | Fabian / online music site | 2026-01-06 | 2026-10-26 |
| CVE-2026-0640 A weakness has been identified in Tenda AC23 16.03.07.52. |
critical | 9.8 | — | Tenda / ac23 firmware | 2026-01-06 | 2026-10-26 |
| CVE-2026-0700 A vulnerability was determined in code-projects Intern Membership Management Sys... |
critical | 9.8 | — | Carmelo / intern membership management system | 2026-01-08 | 2026-10-26 |
| CVE-2026-27650 OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-32669 Code injection vulnerability exists in BUFFALO Wi-Fi router products. |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-33280 Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may al... |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.