October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,595
Critical
3,298
High
7,976
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2019-2725 Oracle WebLogic Server, Injection |
critical | 9.8 | Listed | Oracle / WebLogic Server | 2019-04-26 | 2026-10-01 |
| CVE-2018-19323 GIGABYTE Multiple Products Privilege Escalation Vulnerability |
critical | 9.8 | Listed | GIGABYTE / Multiple Products | 2018-12-21 | 2026-10-01 |
| CVE-2026-79898 Fortra BoKS Manager contains a command injection vulnerability in crlserver. |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-12627 Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer ove... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103752 Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-62071 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. |
critical | 9.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56660 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103255 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
critical | 9.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2020-0796 Microsoft SMBv3 Remote Code Execution Vulnerability |
critical | 10.0 | Listed | Microsoft / SMBv3 | 2020-03-12 | 2026-10-01 |
| CVE-2016-1019 Adobe Flash Player Arbitrary Code Execution Vulnerability |
critical | 9.8 | Listed | Adobe / Flash Player | 2016-04-07 | 2026-10-01 |
| CVE-2012-1710 Oracle Fusion Middleware Unspecified Vulnerability |
critical | 9.8 | Listed | Oracle / Fusion Middleware | 2012-05-03 | 2026-10-01 |
| CVE-2026-92173 Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be indu... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51870 DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/she... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51859 bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in sa... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51864 DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (pac... |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103044 XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundat... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-100240 Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - Template... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2024-7399 Samsung MagicINFO 9 Server Path Traversal Vulnerability |
critical | 9.8 | Listed | Samsung / MagicINFO 9 Server | 2024-08-12 | 2026-10-01 |
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overfl... |
critical | 9.0 | Listed | Ivanti / Connect Secure, Policy Secure, and ZTA Gateways | 2025-01-08 | 2026-10-01 |
| CVE-2021-22175 GitLab Server-Side Request Forgery (SSRF) Vulnerability |
critical | 9.8 | Listed | GitLab / GitLab | 2021-06-11 | 2026-10-01 |
| CVE-2026-58185 The Apache Traffic Server intercept plugin has a use-after-free. |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-58179 The Apache Traffic Server regex_remap plugin overflows the stack and integers fr... |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-58163 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr... |
critical | 9.1 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-95284 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-51866 In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/uplo... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51871 Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in sr... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51856 In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-81440 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81475 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Mis... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81476 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-82829 Hitachi Coding Software Suite contains a vulnerability related to Hidden Functio... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82824 Hitachi Coding Software Suite contains a vulnerability related to Path Traversal... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82825 Hitachi Coding Software Suite contains a vulnerability related to Missing Authen... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82827 Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-co... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102793 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102361 mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-101261 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101264 A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2025-9925 A vulnerability was found in projectworlds Travel Management System 1.0. |
critical | 9.8 | — | Projectworlds / travel management system | 2025-09-03 | 2026-10-01 |
| CVE-2025-10079 A flaw has been found in PHPGurukul Small CRM 4.0. |
critical | 9.8 | — | Phpgurukul / small crm | 2025-09-08 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.