October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-33280 Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may al... |
critical | 9.8 | — | Buffalo / wcr-1166dhpl firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-4620 OS Command Injection vulnerability in NEC Platforms, Ltd. |
critical | 9.8 | — | Nec / aterm wx3600hp firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-4622 OS Command Injection vulnerability in NEC Platforms, Ltd. |
critical | 9.8 | — | Nec / aterm wg2600hs firmware | 2026-03-27 | 2026-10-26 |
| CVE-2026-33770 WWBN AVideo is an open source video platform. |
critical | 9.8 | — | Wwbn / avideo | 2026-03-27 | 2026-10-26 |
| CVE-2026-4963 A weakness has been identified in huggingface smolagents 1.25.0.dev0. |
critical | 10.0 | — | Huggingface / smolagents | 2026-03-27 | 2026-10-26 |
| CVE-2026-33654 nanobot is a personal AI assistant. |
critical | 9.8 | — | Nanobot / nanobot | 2026-03-27 | 2026-10-26 |
| CVE-2026-33896 Forge (also called `node-forge`) is a native implementation of Transport Layer S... |
critical | 9.1 | — | Digitalbazaar / forge | 2026-03-27 | 2026-10-26 |
| CVE-2026-33993 Locutus brings stdlibs of other programming languages to JavaScript for educatio... |
critical | 9.8 | — | Locutus / locutus | 2026-03-27 | 2026-10-26 |
| CVE-2026-5256 A flaw has been found in code-projects Simple Laundry System 1.0. |
critical | 9.8 | — | Code-projects / simple laundry system | 2026-04-01 | 2026-10-26 |
| CVE-2026-5257 A vulnerability has been found in code-projects Simple Laundry System 1.0. |
critical | 9.8 | — | Code-projects / simple laundry system | 2026-04-01 | 2026-10-26 |
| CVE-2026-34236 Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. |
critical | 9.8 | — | Auth0 / auth0-php | 2026-04-01 | 2026-10-26 |
| CVE-2026-4101 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify... |
critical | 9.8 | — | Ibm / security verify access | 2026-04-01 | 2026-10-26 |
| CVE-2026-34559 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34560 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34562 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34566 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-34571 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-01 | 2026-10-26 |
| CVE-2026-29133 SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker to upload... |
critical | 9.1 | — | Seppmail / secure email gateway | 2026-04-02 | 2026-10-26 |
| CVE-2026-29139 SEPPmail Secure Email Gateway before version 15.0.3 allows account takeover by a... |
critical | 9.8 | — | Seppmail / secure email gateway | 2026-04-02 | 2026-10-26 |
| CVE-2026-29143 SEPPmail Secure Email Gateway before version 15.0.3 does not properly authentica... |
critical | 9.1 | — | Seppmail / secure email gateway | 2026-04-02 | 2026-10-26 |
| CVE-2026-5333 A security flaw has been discovered in DefaultFuction Content-Management-System... |
critical | 9.8 | — | Defaultfuction / content management system | 2026-04-02 | 2026-10-26 |
| CVE-2026-5334 A weakness has been identified in itsourcecode Online Enrollment System 1.0. |
critical | 9.8 | — | Itsourcecode / online enrollment system | 2026-04-02 | 2026-10-26 |
| CVE-2026-32871 FastMCP is a Pythonic way to build MCP servers and clients. |
critical | 10.0 | — | Jlowin / fastmcp | 2026-04-02 | 2026-10-26 |
| CVE-2026-34444 Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. |
critical | 10.0 | — | Scoder / lupa | 2026-04-06 | 2026-10-26 |
| CVE-2026-23818 A vulnerability has been identified in the graphical user interface (GUI) of HPE... |
critical | 9.6 | — | Hpe / aruba networking private 5g core | 2026-04-07 | 2026-10-26 |
| CVE-2026-39305 PraisonAI is a multi-agent teams system. |
critical | 10.0 | — | Praison / praisonai | 2026-04-07 | 2026-10-26 |
| CVE-2026-39324 Rack::Session is a session management implementation for Rack. |
critical | 9.8 | — | Rack / rack-session | 2026-04-07 | 2026-10-26 |
| CVE-2026-5849 A vulnerability was determined in Tenda i12 1.0.0.11(3862). |
critical | 9.8 | — | Tenda / i12 firmware | 2026-04-09 | 2026-10-26 |
| CVE-2026-34184 AlanWeb SCADA does not enforce authorization for some directories. |
critical | 9.1 | — | Hydrosystem.poznan / control system | 2026-04-09 | 2026-10-26 |
| CVE-2026-5962 A vulnerability was detected in Tenda CH22 1.0.0.6(468). |
critical | 9.8 | — | Tenda / ch22 firmware | 2026-04-09 | 2026-10-26 |
| CVE-2026-5970 A vulnerability was detected in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-5971 A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-5972 A vulnerability has been found in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-5974 A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. |
critical | 9.8 | — | Deepwisdom / metagpt | 2026-04-09 | 2026-10-26 |
| CVE-2026-40114 PraisonAI is a multi-agent teams system. |
critical | 10.0 | — | Praison / praisonai | 2026-04-09 | 2026-10-26 |
| CVE-2026-40154 PraisonAI is a multi-agent teams system. |
critical | 9.6 | — | Praison / praisonai | 2026-04-09 | 2026-10-26 |
| CVE-2026-6024 A vulnerability was determined in Tenda i6 1.0.0.7(2204). |
critical | 9.8 | — | Tenda / i6 firmware | 2026-04-10 | 2026-10-26 |
| CVE-2026-5483 A flaw was found in odh-dashboard in Red Hat Openshift AI. |
critical | 9.9 | — | Redhat / openshift ai | 2026-04-10 | 2026-10-26 |
| CVE-2026-33698 Chamilo LMS is a learning management system. |
critical | 9.8 | — | Chamilo / chamilo lms | 2026-04-10 | 2026-10-26 |
| CVE-2026-33707 Chamilo LMS is a learning management system. |
critical | 9.8 | — | Chamilo / chamilo lms | 2026-04-10 | 2026-10-26 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.