October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,501
Critical
3,286
High
7,912
Medium
7,604
Low
740
Severity not reported
4,959
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-15247 A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2... |
critical | 9.8 | — | Gmg137 / snap7-rs | 2025-12-30 | 2026-10-07 |
| CVE-2025-15407 A vulnerability has been found in code-projects Online Guitar Store 1.0. |
critical | 9.8 | — | Anisha / online guitar store | 2026-01-01 | 2026-10-07 |
| CVE-2025-15408 A vulnerability was found in code-projects Online Guitar Store 1.0. |
critical | 9.8 | — | Anisha / online guitar store | 2026-01-01 | 2026-10-07 |
| CVE-2025-15409 A vulnerability was determined in code-projects Online Guitar Store 1.0. |
critical | 9.8 | — | Anisha / online guitar store | 2026-01-01 | 2026-10-07 |
| CVE-2025-15410 A vulnerability was identified in code-projects Online Guitar Store 1.0. |
critical | 9.8 | — | Anisha / online guitar store | 2026-01-01 | 2026-10-07 |
| CVE-2025-15420 A security vulnerability has been detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15421 A vulnerability was detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15424 A vulnerability was found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15425 A vulnerability was determined in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15434 A vulnerability was detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15435 A flaw has been found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15436 A vulnerability has been found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-64121 Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvati... |
critical | 9.8 | — | Nuvationenergy / nplatform | 2026-01-02 | 2026-10-07 |
| CVE-2025-64123 Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Co... |
critical | 9.8 | — | Nuvationenergy / nplatform | 2026-01-02 | 2026-10-07 |
| CVE-2025-15115 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authenticat... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-3653 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper ac... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-3654 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-15448 A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf... |
critical | 9.8 | — | Cld378632668 / javamall | 2026-01-05 | 2026-10-07 |
| CVE-2025-15449 A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec94... |
critical | 9.1 | — | Cld378632668 / javamall | 2026-01-05 | 2026-10-07 |
| CVE-2025-15457 A vulnerability was found in bg5sbk MiniCMS up to 1.8. |
critical | 9.8 | — | 1234n / minicms | 2026-01-05 | 2026-10-07 |
| CVE-2025-15458 A vulnerability was determined in bg5sbk MiniCMS up to 1.8. |
critical | 9.8 | — | 1234n / minicms | 2026-01-05 | 2026-10-07 |
| CVE-2025-59467 A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices P... |
critical | 9.6 | — | Ui / argentina afip invoices | 2026-01-05 | 2026-10-07 |
| CVE-2025-55204 muffon is a cross-platform music streaming client for desktop. |
critical | 9.6 | — | Muffon / muffon | 2026-01-05 | 2026-10-07 |
| CVE-2025-68456 Craft is a platform for creating digital experiences. |
critical | 9.1 | — | Craftcms / craft cms | 2026-01-05 | 2026-10-07 |
| CVE-2025-14942 wolfSSH’s key exchange state machine can be manipulated to leak the client’s pas... |
critical | 9.8 | — | Wolfssh / wolfssh | 2026-01-06 | 2026-10-07 |
| CVE-2025-55125 This vulnerability allows a Backup or Tape Operator to perform remote code execu... |
critical | 9.8 | — | Veeam / veeam backup \& replication | 2026-01-08 | 2026-10-07 |
| CVE-2025-59468 This vulnerability allows a Backup Administrator to perform remote code executio... |
critical | 9.1 | — | Veeam / veeam backup \& replication | 2026-01-08 | 2026-10-07 |
| CVE-2025-15480 In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user cr... |
critical | 9.1 | — | Canonical / ubuntu desktop provision | 2026-04-09 | 2026-10-07 |
| CVE-2025-31991 Rate Limiting for attempting a user login is not being properly enforced, making... |
critical | 9.8 | — | Hcltech / devops velocity | 2026-04-13 | 2026-10-07 |
| CVE-2025-15625 Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Clou... |
critical | 9.8 | — | Sparxsystems / pro cloud server | 2026-04-17 | 2026-10-07 |
| CVE-2025-14543 Improper Restriction of XML External Entity Reference vulnerability in RTI Conne... |
critical | 9.1 | — | Rti / connext professional | 2026-04-30 | 2026-10-07 |
| CVE-2025-59851 HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities fl... |
critical | 9.8 | — | Hcltech / dfxanalytics | 2026-05-06 | 2026-10-07 |
| CVE-2025-59852 HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulne... |
critical | 9.1 | — | Hcltech / dfxanalytics | 2026-05-06 | 2026-10-07 |
| CVE-2025-40639 A SQL injection vulnerability has been found in Eventobot. |
critical | 9.8 | — | Sbitsoft / eventobot | 2026-03-09 | 2026-10-07 |
| CVE-2025-13392 Improper check for unusual or exceptional conditions vulnerability in SSO in Syn... |
critical | 9.8 | — | Synology / diskstation manager | 2026-05-27 | 2026-10-07 |
| CVE-2026-91140 An OS command injection vulnerability in the shell-based temporary-file cleanup... |
critical | 9.6 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-55330 In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105135 A vulnerability has been found in InternLM MindSearch 0.1.0. |
critical | 10.0 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-35053 OneUptime is an open-source monitoring and observability platform. |
critical | 9.8 | — | Hackerbay / oneuptime | 2026-04-02 | 2026-10-06 |
| CVE-2026-31818 Budibase is an open-source low-code platform. |
critical | 9.9 | — | Budibase / budibase | 2026-04-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.