October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-4149 Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerabil... |
critical | 9.8 | — | Sonos / era 300 firmware | 2026-04-11 | 2026-10-26 |
| CVE-2026-40446 Access of resource using incompatible type ('type confusion') vulnerability in S... |
critical | 9.8 | — | Samsung / escargot | 2026-04-13 | 2026-10-26 |
| CVE-2026-5936 An attacker can control a server-side HTTP request by supplying a crafted URL, c... |
critical | 9.8 | — | Foxit / pdf services api | 2026-04-13 | 2026-10-26 |
| CVE-2026-40315 PraisonAI is a multi-agent teams system. |
critical | 9.8 | — | Praison / praisonai | 2026-04-14 | 2026-10-26 |
| CVE-2026-27246 Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cro... |
critical | 9.3 | — | Adobe / connect | 2026-04-14 | 2026-10-26 |
| CVE-2026-33808 Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing... |
critical | 9.1 | — | Fastify / fastify\/express | 2026-04-15 | 2026-10-26 |
| CVE-2026-6290 Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plu... |
critical | 9.1 | — | Rapid7 / velociraptor | 2026-04-15 | 2026-10-26 |
| CVE-2026-41153 In JetBrains Junie before 252.549.29 command execution was possible via maliciou... |
critical | 9.8 | — | Jetbrains / junie | 2026-04-17 | 2026-10-26 |
| CVE-2026-32311 Flowsint is an open-source OSINT graph exploration tool designed for cybersecuri... |
critical | 9.8 | — | Flowsint / flowsint | 2026-04-20 | 2026-10-26 |
| CVE-2026-39861 Claude Code is an agentic coding tool. |
critical | 10.0 | — | Anthropic / claude code | 2026-04-21 | 2026-10-26 |
| CVE-2026-41304 WWBN AVideo is an open source video platform. |
critical | 9.8 | — | Wwbn / avideo | 2026-04-22 | 2026-10-26 |
| CVE-2026-5935 IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TS... |
critical | 9.8 | — | Ibm / total storage service console | 2026-04-23 | 2026-10-26 |
| CVE-2026-3960 A critical remote code execution vulnerability exists in the unauthenticated RES... |
critical | 9.8 | — | H2o / h2o | 2026-04-23 | 2026-10-26 |
| CVE-2026-25874 LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as... |
critical | 9.8 | — | Huggingface / lerobot | 2026-04-23 | 2026-10-26 |
| CVE-2026-41265 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41268 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-41276 Flowise is a drag & drop user interface to build a customized large language mod... |
critical | 9.8 | — | Flowiseai / flowise | 2026-04-23 | 2026-10-26 |
| CVE-2026-25660 CodeChecker is an analyzer tooling, defect database and viewer extension for the... |
critical | 9.8 | — | Ericsson / codechecker | 2026-04-24 | 2026-10-26 |
| CVE-2026-7036 A vulnerability was identified in Tenda i9 1.0.0.5(2204). |
critical | 9.8 | — | Tenda / i9 firmware | 2026-04-26 | 2026-10-26 |
| CVE-2026-40514 SmarterTools SmarterMail builds prior to 9610 contain a cryptographic weakness i... |
critical | 9.1 | — | Smartertools / smartermail | 2026-04-27 | 2026-10-26 |
| CVE-2026-33446 CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Sec... |
critical | 9.8 | — | Absolute / secure access | 2026-04-30 | 2026-10-26 |
| CVE-2026-91622 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
critical | 9.3 | — | — | 2026-10-20 | 2026-10-26 |
| CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability |
critical | 9.8 | Listed | Fortinet / FortiSandbox | 2026-04-14 | 2026-10-26 |
| CVE-2025-67066 SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker... |
critical | 9.8 | — | — | 2026-09-04 | 2026-10-26 |
| CVE-2025-55787 In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerabili... |
critical | 9.8 | — | — | 2026-09-17 | 2026-10-26 |
| CVE-2025-70516 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2025-70520 The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce... |
critical | 9.8 | — | — | 2026-10-07 | 2026-10-26 |
| CVE-2026-0546 A vulnerability was determined in code-projects Content Management System 1.0. |
critical | 9.8 | — | Code-projects / content management system | 2026-01-02 | 2026-10-26 |
| CVE-2026-0585 A security vulnerability has been detected in code-projects Online Product Reser... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0590 A vulnerability was determined in code-projects Online Product Reservation Syste... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0591 A vulnerability was identified in code-projects Online Product Reservation Syste... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0592 A security flaw has been discovered in code-projects Online Product Reservation... |
critical | 9.8 | — | Fabian / online product reservation system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0597 A flaw has been found in Campcodes Supplier Management System 1.0. |
critical | 9.8 | — | Campcodes / supplier management system | 2026-01-05 | 2026-10-26 |
| CVE-2026-0605 A security vulnerability has been detected in code-projects Online Music Site 1.... |
critical | 9.8 | — | Fabian / online music site | 2026-01-05 | 2026-10-26 |
| CVE-2026-0606 A vulnerability was detected in code-projects Online Music Site 1.0. |
critical | 9.8 | — | Fabian / online music site | 2026-01-05 | 2026-10-26 |
| CVE-2026-0607 A flaw has been found in code-projects Online Music Site 1.0. |
critical | 9.8 | — | Fabian / online music site | 2026-01-06 | 2026-10-26 |
| CVE-2026-0640 A weakness has been identified in Tenda AC23 16.03.07.52. |
critical | 9.8 | — | Tenda / ac23 firmware | 2026-01-06 | 2026-10-26 |
| CVE-2026-0700 A vulnerability was determined in code-projects Intern Membership Management Sys... |
critical | 9.8 | — | Carmelo / intern membership management system | 2026-01-08 | 2026-10-26 |
| CVE-2026-27650 OS Command Injection vulnerability exists in BUFFALO Wi-Fi router products. |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-32669 Code injection vulnerability exists in BUFFALO Wi-Fi router products. |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.