October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,482
Critical
3,286
High
7,908
Medium
7,600
Low
740
Severity not reported
4,948
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-13303 A vulnerability was determined in code-projects Courier Management System 1.0. |
critical | 9.8 | — | Carmelogarcia / courier management system | 2025-11-17 | 2026-10-07 |
| CVE-2025-13485 A security flaw has been discovered in itsourcecode Online File Management Syste... |
critical | 9.8 | — | Admerc / file management system | 2025-11-21 | 2026-10-07 |
| CVE-2025-64762 The AuthKit library for Next.js provides convenient helpers for authentication a... |
critical | 9.1 | — | Workos / authkit-nextjs | 2025-11-21 | 2026-10-07 |
| CVE-2026-101110 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library... |
critical | 9.8 | — | Ordasoft / book library | 2026-09-28 | 2026-10-07 |
| CVE-2026-102266 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-102268 PyJWT is a Python implementation of JSON Web Token standards. |
critical | 9.1 | — | Pyjwt Project / pyjwt | 2026-09-28 | 2026-10-07 |
| CVE-2026-76746 An unauthenticated buffer overflow vulnerability exists in AOS-S. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-76747 Buffer overflow vulnerabilities exist in the affected interface of AOS-S. |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability |
critical | 10.0 | Listed | SimpleHelp / SimpleHelp | 2026-06-12 | 2026-10-07 |
| CVE-2026-91012 org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),... |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2026-91048 The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. |
critical | 9.8 | — | Apache / karaf | 2026-09-29 | 2026-10-07 |
| CVE-2025-14611 Gladinet CentreStack and Triofox Hard Coded Cryptographic Vulnerability |
critical | 9.8 | Listed | Gladinet / CentreStack and Triofox | 2025-12-12 | 2026-10-07 |
| CVE-2025-65112 PubNet is a self-hosted Dart & Flutter package service. |
critical | 9.8 | — | Ricardoboss / pubnet | 2025-11-29 | 2026-10-07 |
| CVE-2025-66219 willitmerge is a command line tool to check if pull requests are mergeable. |
critical | 9.8 | — | Dontkry / willitmerge | 2025-11-29 | 2026-10-07 |
| CVE-2025-66216 AIS-catcher is a multi-platform AIS receiver. |
critical | 9.8 | — | Aiscatcher / ais-catcher | 2025-11-29 | 2026-10-07 |
| CVE-2025-13782 A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967b... |
critical | 9.8 | — | Wtcms Project / wtcms | 2025-11-30 | 2026-10-07 |
| CVE-2025-14182 A vulnerability has been found in Sobey Media Convergence System 2.0/2.1. |
critical | 9.8 | — | Sobey / media convergence system | 2025-12-07 | 2026-10-07 |
| CVE-2025-14209 A weakness has been identified in Campcodes School File Management System 1.0. |
critical | 9.8 | — | Campcodes / school file management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14210 A security vulnerability has been detected in projectworlds Advanced Library Man... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14211 A vulnerability was detected in projectworlds Advanced Library Management System... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14212 A flaw has been found in projectworlds Advanced Library Management System 1.0. |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14215 A vulnerability was found in code-projects Currency Exchange System 1.0. |
critical | 9.8 | — | Fabian / currency exchange system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14216 A vulnerability was determined in code-projects Currency Exchange System 1.0. |
critical | 9.8 | — | Fabian / currency exchange system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14217 A vulnerability was identified in code-projects Currency Exchange System 1.0. |
critical | 9.8 | — | Fabian / currency exchange system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14218 A security flaw has been discovered in code-projects Currency Exchange System 1.... |
critical | 9.8 | — | Fabian / currency exchange system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14223 A vulnerability has been found in code-projects Simple Leave Manager 1.0. |
critical | 9.8 | — | Carmelo / simple leave manager | 2025-12-08 | 2026-10-07 |
| CVE-2025-14224 A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. |
critical | 9.8 | — | Yottamaster / dm2 firmware | 2025-12-08 | 2026-10-07 |
| CVE-2025-14226 A vulnerability was identified in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14227 A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e5... |
critical | 9.8 | — | Philipinho / simple-php-blog | 2025-12-08 | 2026-10-07 |
| CVE-2025-14246 A vulnerability was found in code-projects Simple Shopping Cart 1.0. |
critical | 9.8 | — | Fabian / simple shopping cart | 2025-12-08 | 2026-10-07 |
| CVE-2025-14247 A vulnerability was determined in code-projects Simple Shopping Cart 1.0. |
critical | 9.8 | — | Fabian / simple shopping cart | 2025-12-08 | 2026-10-07 |
| CVE-2025-14248 A vulnerability was identified in code-projects Simple Shopping Cart 1.0. |
critical | 9.8 | — | Fabian / simple shopping cart | 2025-12-08 | 2026-10-07 |
| CVE-2025-14249 A security flaw has been discovered in code-projects Online Ordering System 1.0. |
critical | 9.8 | — | Fabian / online ordering system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14250 A weakness has been identified in code-projects Online Ordering System 1.0. |
critical | 9.8 | — | Fabian / online ordering system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14251 A security vulnerability has been detected in code-projects Online Ordering Syst... |
critical | 9.8 | — | Fabian / online ordering system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14256 A vulnerability was detected in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-14257 A flaw has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-08 | 2026-10-07 |
| CVE-2025-48626 In multiple locations, there is a possible way to launch an application from the... |
critical | 9.8 | — | Google / android | 2025-12-08 | 2026-10-07 |
| CVE-2025-14258 A vulnerability has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-08 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.