October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 29, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
22,204
Critical
3,101
High
7,090
Medium
6,615
Low
672
Severity not reported
4,726
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1176), google (780), ibm (323), mozilla (182), oracle (154), adobe (137), linux (126), apache (116), broadcom (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-33707 Chamilo LMS is a learning management system. |
critical | 9.8 | — | Chamilo / chamilo lms | 2026-04-10 | 2026-10-26 |
| CVE-2026-40190 LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. |
critical | 9.8 | — | Langchain / langsmith | 2026-04-10 | 2026-10-26 |
| CVE-2026-6110 A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-12 | 2026-10-26 |
| CVE-2026-40393 In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occu... |
critical | 9.8 | — | Mesa3d / mesa | 2026-04-12 | 2026-10-26 |
| CVE-2026-25205 Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-25206 Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource... |
critical | 9.1 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-25207 Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-25209 Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource... |
critical | 9.1 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-34865 Out-of-bounds write vulnerability in the WEB module.Impact: Successful exploitat... |
critical | 9.1 | — | Huawei / harmonyos | 2026-04-13 | 2026-10-26 |
| CVE-2026-0234 An improper verification of cryptographic signature vulnerability exists in Cort... |
critical | 9.1 | — | Paloaltonetworks / cortex xsiam | 2026-04-13 | 2026-10-26 |
| CVE-2026-2332 In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch... |
critical | 9.1 | — | Eclipse / jetty | 2026-04-14 | 2026-10-26 |
| CVE-2026-27243 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-27245 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-27303 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserializati... |
critical | 9.6 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-5189 CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager vers... |
critical | 9.8 | — | Sonatype / nexus repository manager | 2026-04-15 | 2026-10-26 |
| CVE-2026-27820 zlib is a Ruby interface for the zlib compression/decompression library. |
critical | 9.8 | — | Ruby-lang / zlib | 2026-04-16 | 2026-10-26 |
| CVE-2026-40518 ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary... |
critical | 9.1 | — | Bytedance / deerflow | 2026-04-17 | 2026-10-26 |
| CVE-2026-33516 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-04-17 | 2026-10-26 |
| CVE-2026-33689 xrdp is an open source RDP server. |
critical | 9.1 | — | Neutrinolabs / xrdp | 2026-04-17 | 2026-10-26 |
| CVE-2026-5720 miniupnpd contains an integer underflow vulnerability in SOAPAction header parsi... |
critical | 9.1 | — | Miniupnp Project / miniupnpd | 2026-04-17 | 2026-10-26 |
| CVE-2026-40487 Postiz is an AI social media scheduling tool. |
critical | 9.0 | — | Gitroom / postiz | 2026-04-18 | 2026-10-26 |
| CVE-2026-6643 A stack-based buffer overflow vulnerability was found in the VPN Clients on the... |
critical | 9.9 | — | Asustor / data master | 2026-04-20 | 2026-10-26 |
| CVE-2026-6644 A command injection vulnerability was found in the PPTP VPN Clients on the ADM. |
critical | 9.1 | — | Asustor / data master | 2026-04-20 | 2026-10-26 |
| CVE-2026-40892 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.8 | — | Pjsip / pjsip | 2026-04-21 | 2026-10-26 |
| CVE-2026-40910 frp is a fast reverse proxy. |
critical | 9.1 | — | Fatedier / frp | 2026-04-21 | 2026-10-26 |
| CVE-2026-5845 An improper authorization vulnerability in scoped user-to-server (ghu_) token au... |
critical | 9.6 | — | Github / enterprise server | 2026-04-21 | 2026-10-26 |
| CVE-2026-41144 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
critical | 9.8 | — | Nasa / fprime | 2026-04-22 | 2026-10-26 |
| CVE-2026-6023 In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the R... |
critical | 9.8 | — | Progress / telerik ui for asp.net ajax | 2026-04-22 | 2026-10-26 |
| CVE-2026-33598 A cached crafted response can cause an out-of-bounds read if custom Lua code cal... |
critical | 9.1 | — | Powerdns / dnsdist | 2026-04-22 | 2026-10-26 |
| CVE-2026-33608 An attacker can send a notify request that causes a new secondary domain to be a... |
critical | 9.8 | — | Powerdns / authoritative | 2026-04-22 | 2026-10-26 |
| CVE-2026-26354 Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Re... |
critical | 9.8 | — | Dell / powerprotect dp series appliance | 2026-04-22 | 2026-10-26 |
| CVE-2026-41211 Vite+ is a unified toolchain and entry point for web development. |
critical | 10.0 | — | Voidzero / vite\+ | 2026-04-23 | 2026-10-26 |
| CVE-2026-41247 elFinder is an open-source file manager for web, written in JavaScript using jQu... |
critical | 9.8 | — | Std42 / elfinder | 2026-04-23 | 2026-10-26 |
| CVE-2026-41264 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41267 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-26150 Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized a... |
critical | 10.0 | — | Microsoft / purview ediscovery | 2026-04-23 | 2026-10-26 |
| CVE-2026-33819 Deserialization of untrusted data in Microsoft Bing allows an unauthorized attac... |
critical | 9.8 | — | Microsoft / bing | 2026-04-23 | 2026-10-26 |
| CVE-2026-41274 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41415 PJSIP is a free and open source multimedia communication library written in C. |
critical | 9.1 | — | Teluu / pjsip | 2026-04-24 | 2026-10-26 |
| CVE-2026-41473 CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerabilit... |
critical | 9.1 | — | Cyberpanel / cyberpanel | 2026-04-24 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.