October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-73602 Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScri... |
critical | 9.9 | — | Flowiseai / flowise | 2026-08-13 | 2026-10-24 |
| CVE-2026-99078 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-99079 In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e:... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98959 In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix... |
critical | 9.8 | — | — | 2026-10-23 | 2026-10-24 |
| CVE-2026-98548 In the Linux kernel, the following vulnerability has been resolved:
sctp: disca... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-24 |
| CVE-2026-98464 In the Linux kernel, the following vulnerability has been resolved:
RISC-V: KVM... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-24 |
| CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
critical | 9.8 | Listed | JetBrains / TeamCity | 2026-07-27 | 2026-10-24 |
| CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability |
critical | 10.0 | Listed | Arista / VeloCloud Orchestrator | 2026-07-27 | 2026-10-24 |
| CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability |
critical | 9.8 | Listed | Check Point / SmartConsole | 2026-07-22 | 2026-10-24 |
| CVE-2023-23080 Certain Tenda products are vulnerable to command injection. |
critical | 9.8 | — | Tenda / it7-lcs firmware | 2023-02-27 | 2026-10-24 |
| CVE-2023-25207 PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.ph... |
critical | 9.8 | — | Prestashop / dpd france | 2023-03-13 | 2026-10-24 |
| CVE-2023-31039 Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers t... |
critical | 9.8 | — | Apache / brpc | 2023-05-08 | 2026-10-24 |
| CVE-2023-27407 A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). |
critical | 9.9 | — | Siemens / scalance lpe9403 firmware | 2023-05-09 | 2026-10-24 |
| CVE-2023-29129 A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All ve... |
critical | 9.8 | — | Mendix / saml | 2023-06-13 | 2026-10-24 |
| CVE-2023-29531 An attacker could have caused an out of bounds memory access using WebGL APIs, l... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2023-34416 Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 1... |
critical | 9.8 | — | Mozilla / firefox | 2023-06-19 | 2026-10-24 |
| CVE-2022-44276 In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions r... |
critical | 9.8 | — | Tecrail / responsive filemanager | 2023-06-28 | 2026-10-24 |
| CVE-2021-25827 Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-F... |
critical | 9.8 | — | Emby / emby | 2023-06-28 | 2026-10-24 |
| CVE-2023-34844 Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing t... |
critical | 9.8 | — | Play With Docker Project / play with docker | 2023-06-29 | 2026-10-24 |
| CVE-2023-29131 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). |
critical | 10.0 | — | Siemens / simatic cn 4100 firmware | 2023-07-11 | 2026-10-24 |
| CVE-2026-35035 CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo... |
critical | 9.0 | — | Ci4-cms-erp / ci4ms | 2026-04-06 | 2026-10-24 |
| CVE-2026-29009 U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readli... |
critical | 9.8 | — | Denx / u-boot | 2026-07-08 | 2026-10-24 |
| CVE-2026-50252 In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is rand... |
critical | 9.3 | — | Nlnetlabs / unbound | 2026-07-22 | 2026-10-24 |
| CVE-2026-64815 In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible v... |
critical | 9.8 | — | Jetbrains / intellij idea | 2026-07-23 | 2026-10-24 |
| CVE-2026-65906 In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s... |
critical | 10.0 | — | Jetbrains / teamcity | 2026-07-23 | 2026-10-24 |
| CVE-2026-10697 Improper Authentication vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-15966 Permissive cross-domain security policy with untrusted domains vulnerability in... |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-15967 Insufficient session expiration vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-07-23 | 2026-10-24 |
| CVE-2026-56160 Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att... |
critical | 9.9 | — | Microsoft / azure red hat openshift | 2026-07-24 | 2026-10-24 |
| CVE-2026-58275 Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr... |
critical | 9.8 | — | Microsoft / azure dns | 2026-07-24 | 2026-10-24 |
| CVE-2026-62825 Improper authentication in Azure Key Vault allows an unauthorized attacker to el... |
critical | 9.8 | — | Microsoft / azure key vault | 2026-07-24 | 2026-10-24 |
| CVE-2026-58630 Improper access control in Azure App Service allows an unauthorized attacker to... |
critical | 9.8 | — | Microsoft / azure app service for linux | 2026-07-24 | 2026-10-24 |
| CVE-2026-48144 Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-55971 Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. |
critical | 9.8 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58023 Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-58662 Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi... |
critical | 9.1 | — | Apache / thrift | 2026-07-27 | 2026-10-24 |
| CVE-2026-8470 IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.... |
critical | 9.1 | — | Langflow / langflow | 2026-08-05 | 2026-10-24 |
| CVE-2026-9205 IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in t... |
critical | 9.8 | — | Langflow / langflow | 2026-08-05 | 2026-10-24 |
| CVE-2026-76886 C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows den... |
critical | 9.8 | — | Wireshark / wireshark | 2026-08-19 | 2026-10-24 |
| CVE-2026-105014 Improper neutralization of special elements used in a command ('command injectio... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.