October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-47826 The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at... |
critical | 9.1 | — | Cloudfoundry / bosh cli | 2026-07-09 | 2026-10-25 |
| CVE-2026-58459 gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injecti... |
critical | 9.6 | — | Gpsd Project / gpsd | 2026-07-09 | 2026-10-25 |
| CVE-2026-58521 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | Mediawiki / cargo | 2026-07-01 | 2026-10-25 |
| CVE-2026-14363 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | Mediawiki / cargo | 2026-07-01 | 2026-10-25 |
| CVE-2026-12481 A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe... |
critical | 9.8 | — | Keras / keras | 2026-07-03 | 2026-10-25 |
| CVE-2026-57983 Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized... |
critical | 10.0 | — | Microsoft / edge chromium | 2026-07-03 | 2026-10-25 |
| CVE-2026-14535 In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImports... |
critical | 9.8 | — | Trailofbits / fickling | 2026-07-04 | 2026-10-25 |
| CVE-2026-57211 RabbitMQ is a messaging and streaming broker. |
critical | 10.0 | — | Broadcom / rabbitmq server | 2026-07-10 | 2026-10-25 |
| CVE-2026-57216 RabbitMQ is a messaging and streaming broker. |
critical | 10.0 | — | Broadcom / rabbitmq server | 2026-07-10 | 2026-10-25 |
| CVE-2026-57827 Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles compone... |
critical | 9.8 | — | Rsjoomla / rsfiles\! | 2026-07-11 | 2026-10-25 |
| CVE-2026-56372 ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the... |
critical | 9.1 | — | Imagemagick / imagemagick | 2026-07-11 | 2026-10-25 |
| CVE-2026-59792 In JetBrains IntelliJ IDEA before 2026.1.4,
2026.2 code execution via path trav... |
critical | 9.8 | — | Jetbrains / intellij idea | 2026-07-10 | 2026-10-24 |
| CVE-2026-57830 Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in H... |
critical | 9.1 | — | Ollyo / helix ultimate | 2026-07-13 | 2026-10-24 |
| CVE-2026-40468 Integer overflow vulnerability has been found in "builtin.c" program file of gaw... |
critical | 9.1 | — | Fossies / gawk | 2026-07-13 | 2026-10-24 |
| CVE-2026-40469 Integer overflow vulnerability has been found in "builtin.c" program file of gaw... |
critical | 9.1 | — | Fossies / gawk | 2026-07-13 | 2026-10-24 |
| CVE-2026-13221 Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 befo... |
critical | 9.1 | — | Perl / perl | 2026-07-13 | 2026-10-24 |
| CVE-2026-46634 Twig is a template language for PHP. |
critical | 9.8 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48805 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48806 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-48807 Twig is a template language for PHP. |
critical | 9.1 | — | Symfony / twig | 2026-07-14 | 2026-10-24 |
| CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability |
critical | 10.0 | Listed | SonicWall / SMA1000 Appliances | 2026-07-14 | 2026-10-24 |
| CVE-2026-58319 Certain Apache Doris FE HTTP REST administrative APIs were accessible without pr... |
critical | 9.1 | — | Apache / doris | 2026-07-14 | 2026-10-24 |
| CVE-2026-62422 In JetBrains YouTrack before 2026.1.13757,
2025.3.148033,
2025.2.148048,
2025.1.... |
critical | 9.8 | — | Jetbrains / youtrack | 2026-07-14 | 2026-10-24 |
| CVE-2026-62390 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2026-62392 Improper Neutralization of Special Elements used in an OS Command ('OS Command I... |
critical | 9.8 | — | Apache / kylin | 2026-07-14 | 2026-10-24 |
| CVE-2026-59836 A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3... |
critical | 9.8 | — | Fortinet / forticlientems | 2026-07-14 | 2026-10-24 |
| CVE-2026-62643 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascadin... |
critical | 10.0 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-62644 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin o... |
critical | 9.8 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-54058 Pillow is a Python imaging library. |
critical | 9.1 | — | Python / pillow | 2026-07-14 | 2026-10-24 |
| CVE-2026-54433 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross... |
critical | 10.0 | — | Roundcube / webmail | 2026-07-14 | 2026-10-24 |
| CVE-2026-58617 Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized... |
critical | 9.8 | — | Microsoft / 365 copilot | 2026-07-14 | 2026-10-24 |
| CVE-2026-24227 NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial... |
critical | 9.8 | — | Nvidia / tensorrt | 2026-07-14 | 2026-10-24 |
| CVE-2026-20156 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / roomos | 2026-07-15 | 2026-10-24 |
| CVE-2026-20157 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Cisco / roomos | 2026-07-15 | 2026-10-24 |
| CVE-2026-54052 n8n-MCP is an MCP server that provides AI assistants access to n8n node document... |
critical | 9.9 | — | N8n-mcp / n8n-mcp | 2026-07-15 | 2026-10-24 |
| CVE-2026-56453 HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vu... |
critical | 9.8 | — | Hcltech / dfxanalytics | 2026-07-16 | 2026-10-24 |
| CVE-2026-91403 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Ente... |
critical | 9.1 | — | — | 2026-10-21 | 2026-10-24 |
| CVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability |
critical | 9.8 | Listed | Sangoma / Switchvox | 2026-07-17 | 2026-10-24 |
| CVE-2026-9198 IBM Langflow Code Injection Vulnerability |
critical | 9.8 | Listed | IBM / Langflow | 2026-07-17 | 2026-10-24 |
| CVE-2026-45568 zrok is software for sharing web services, files, and network resources. |
critical | 9.1 | — | Netfoundry / zrok | 2026-07-16 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.