October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100752 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate M... |
critical | 9.8 | — | Ordasoft / real estate manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-101108 Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manag... |
critical | 9.8 | — | Ordasoft / vehicle manager | 2026-09-28 | 2026-10-27 |
| CVE-2026-63938 In the Linux kernel, the following vulnerability has been resolved:
KVM: SEV: C... |
critical | 9.3 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2026-91644 Vulnerability in Oracle Essbase (component: Security). |
critical | 9.3 | — | Oracle / essbase | 2026-10-20 | 2026-10-27 |
| CVE-2026-63922 In the Linux kernel, the following vulnerability has been resolved:
ipv6: exthd... |
critical | 9.8 | — | Linux / linux kernel | 2026-07-19 | 2026-10-27 |
| CVE-2025-60553 D-Link DIR600L Ax FW116WWb01 was discovered to contain a buffer overflow via the... |
critical | 9.8 | — | Dlink / dir-600l firmware | 2025-10-24 | 2026-10-27 |
| CVE-2025-60355 zhangyd-c OneBlog v2.3.9 and before was vulnerable to SSTI (Server-Side Template... |
critical | 9.8 | — | Zhyd / oneblog | 2025-10-28 | 2026-10-27 |
| CVE-2025-52910 An issue was discovered in the GPU in Samsung Mobile Processor and Wearable Proc... |
critical | 9.8 | — | Samsung / exynos 1280 firmware | 2025-11-04 | 2026-10-27 |
| CVE-2025-63334 PocketVJ CP PocketVJ-CP-v3 pvj version 3.9.1 contains an unauthenticated remote... |
critical | 9.8 | — | Magdesign / pocketvj control panel firmware | 2025-11-05 | 2026-10-27 |
| CVE-2026-58081 Several encoding modules, including HZ, UTF-7, VIQR, and ZW, did not properly ch... |
critical | 9.8 | — | Freebsd / freebsd | 2026-08-19 | 2026-10-27 |
| CVE-2026-58082 The ISO-2022 encoding module used a stack buffer sized to MB_LEN_MAX (6 bytes) f... |
critical | 9.8 | — | Freebsd / freebsd | 2026-08-19 | 2026-10-27 |
| CVE-2026-72889 Net::OAuth versions before 0.33 for Perl allow the sender to choose the signatur... |
critical | 9.8 | — | — | 2026-08-19 | 2026-10-27 |
| CVE-2026-15065 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker... |
critical | 9.1 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-15068 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote authentic... |
critical | 9.9 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-16656 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to g... |
critical | 9.8 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-16816 IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated... |
critical | 9.9 | — | Ibm / vios | 2026-08-19 | 2026-10-27 |
| CVE-2026-91323 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware... |
critical | 9.8 | — | — | 2026-10-20 | 2026-10-27 |
| CVE-2026-110063 Improper link resolution before file access ('link following') in VM Inspector f... |
critical | 10.0 | — | — | 2026-10-22 | 2026-10-27 |
| CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in For... |
critical | 9.8 | — | — | 2026-10-26 | 2026-10-27 |
| CVE-2026-0578 A vulnerability has been found in code-projects Online Product Reservation Syste... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-04 | 2026-10-26 |
| CVE-2026-4619 Path Traversal vulnerability in NEC Platforms, Ltd. |
critical | 9.8 | — | Nec / aterm wx3600hp firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-34387 Fleet is open source device management software. |
critical | 9.8 | — | Fleetdm / fleet | 2026-03-27 | 2026-10-26 |
| CVE-2026-33765 Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level... |
critical | 9.8 | — | Pi-hole / web interface | 2026-03-27 | 2026-10-26 |
| CVE-2026-34475 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain u... |
critical | 9.8 | — | Varnish-software / varnish enterprise | 2026-03-27 | 2026-10-26 |
| CVE-2026-33879 Federated Learning and Interoperability Platform (FLIP) is an open-source platfo... |
critical | 9.8 | — | Aicentre / federated learning and interoperability platform | 2026-03-27 | 2026-10-26 |
| CVE-2026-33994 Locutus brings stdlibs of other programming languages to JavaScript for educatio... |
critical | 9.8 | — | Locutus / locutus | 2026-03-27 | 2026-10-26 |
| CVE-2026-34430 ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vul... |
critical | 9.6 | — | Deerflow / deerflow | 2026-04-01 | 2026-10-26 |
| CVE-2026-34072 Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, l... |
critical | 9.8 | — | Fccview / cronmaster | 2026-04-01 | 2026-10-26 |
| CVE-2026-34456 Reviactyl is an open-source game server management panel built using Laravel, Re... |
critical | 9.8 | — | Reviactyl / reviactyl | 2026-04-01 | 2026-10-26 |
| CVE-2026-34563 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34564 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34565 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34567 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34569 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-5244 A vulnerability has been found in Cesanta Mongoose up to 7.20. |
critical | 9.8 | — | Cesanta / mongoose | 2026-04-02 | 2026-10-26 |
| CVE-2026-34208 SandboxJS is a JavaScript sandboxing library. |
critical | 10.0 | — | Nyariv / sandboxjs | 2026-04-06 | 2026-10-26 |
| CVE-2026-28808 Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut... |
critical | 9.8 | — | Erlang / erlang\/inets | 2026-04-07 | 2026-10-26 |
| CVE-2026-5841 A weakness has been identified in Tenda i3 1.0.0.6(2204). |
critical | 9.8 | — | Tenda / i3 firmware | 2026-04-09 | 2026-10-26 |
| CVE-2026-34987 Wasmtime is a runtime for WebAssembly. |
critical | 9.9 | — | Bytecodealliance / wasmtime | 2026-04-09 | 2026-10-26 |
| CVE-2026-40189 goshs is a SimpleHTTPServer written in Go. |
critical | 9.8 | — | Goshs / goshs | 2026-04-10 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.