October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,482
Critical
3,286
High
7,908
Medium
7,600
Low
740
Severity not reported
4,948
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-14285 A vulnerability was found in code-projects Employee Profile Management System 1.... |
critical | 9.8 | — | Code-projects / employee profile management system | 2025-12-09 | 2026-10-07 |
| CVE-2025-14321 Use-after-free in the WebRTC: Signaling component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14324 JIT miscompilation in the JavaScript Engine: JIT component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14326 Use-after-free in the Audio/Video: GMP component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-66565 Fiber Utils is a collection of common functions created for Fiber. |
critical | 9.8 | — | Gofiber / utils | 2025-12-09 | 2026-10-07 |
| CVE-2025-66631 CSLA .NET is a framework designed for the development of reusable, object-orient... |
critical | 9.8 | — | Cslanet / csla .net | 2025-12-09 | 2026-10-07 |
| CVE-2025-67504 WBCE CMS is a content management system. |
critical | 9.8 | — | Wbce / wbce cms | 2025-12-09 | 2026-10-07 |
| CVE-2025-14520 A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acb... |
critical | 9.1 | — | Baowzh / hfly | 2025-12-11 | 2026-10-07 |
| CVE-2025-14522 A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1... |
critical | 9.8 | — | Baowzh / hfly | 2025-12-11 | 2026-10-07 |
| CVE-2025-14527 A weakness has been identified in projectworlds Advanced Library Management Syst... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-14529 A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. |
critical | 9.8 | — | Campcodes / retro basketball shoes online store | 2025-12-11 | 2026-10-07 |
| CVE-2025-14536 A security flaw has been discovered in code-projects Class and Exam Timetable Ma... |
critical | 9.8 | — | Fabian / class and exam timetable management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-36937 In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible o... |
critical | 9.8 | — | Google / android | 2025-12-11 | 2026-10-07 |
| CVE-2025-14537 A weakness has been identified in code-projects Class and Exam Timetable Managem... |
critical | 9.8 | — | Fabian / class and exam timetable management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-66588 In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized poi... |
critical | 9.8 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66589 In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerab... |
critical | 9.1 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66590 In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnera... |
critical | 9.8 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66419 MaxKB is an open-source AI assistant for enterprise. |
critical | 10.0 | — | Maxkb / maxkb | 2025-12-11 | 2026-10-07 |
| CVE-2025-67727 Parse Server is an open source backend that can be deployed to any infrastructur... |
critical | 9.8 | — | Parseplatform / parse-server | 2025-12-12 | 2026-10-07 |
| CVE-2025-54947 In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability invo... |
critical | 9.8 | — | Apache / streampark | 2025-12-12 | 2026-10-07 |
| CVE-2025-14565 A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-12-12 | 2026-10-07 |
| CVE-2025-14566 A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd89... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-12-12 | 2026-10-07 |
| CVE-2025-14570 A flaw has been found in projectworlds Advanced Library Management System 1.0. |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14571 A vulnerability has been found in projectworlds Advanced Library Management Syst... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14578 A weakness has been identified in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14583 A flaw has been found in campcodes Online Student Enrollment System 1.0. |
critical | 9.8 | — | Campcodes / online student enrollment system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14584 A vulnerability has been found in itsourcecode COVID Tracking System 1.0. |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14585 A vulnerability was found in itsourcecode COVID Tracking System 1.0. |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-12 | 2026-10-07 |
| CVE-2026-9082 Drupal Core SQL Injection Vulnerability |
critical | 9.8 | Listed | Drupal / Core | 2026-05-20 | 2026-10-07 |
| CVE-2026-97720 Incorrect implementation of JWT/OAuth authentication in Impala executors in Apac... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability |
critical | 10.0 | Listed | Cisco / Identity Services Engine | 2026-09-16 | 2026-10-07 |
| CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability |
critical | 9.8 | Listed | LiteSpeed / cPanel Plugin | 2026-05-21 | 2026-10-07 |
| CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability |
critical | 10.0 | Listed | Ivanti / Sentry | 2026-06-09 | 2026-10-07 |
| CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2021-21351 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.1 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21347 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21350 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21344 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21345 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.9 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.