October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,937
Critical
3,121
High
7,064
Medium
6,901
Low
608
Severity not reported
4,243
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-65890 Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gri... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.2... |
critical | 9.8 | — | Balbooa / gridbox | 2026-07-29 | 2026-10-23 |
| CVE-2026-14537 Incorrect Authorization in the direct HTTP API tool invocation endpoint in Googl... |
critical | 9.8 | — | Google / mcp toolbox for databases | 2026-07-31 | 2026-10-23 |
| CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query pas... |
critical | 9.0 | — | Pgadmin / pgadmin 4 | 2026-07-31 | 2026-10-23 |
| CVE-2026-21662 Unrestricted upload of file with dangerous type vulnerability in Johnson Control... |
critical | 9.8 | — | Johnsoncontrols / fms employee | 2026-07-31 | 2026-10-23 |
| CVE-2026-66321 Access of resource using incompatible type ('type confusion') in Microsoft Edge... |
critical | 9.6 | — | Microsoft / edge chromium | 2026-08-04 | 2026-10-23 |
| CVE-2021-48014 FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportS... |
critical | 9.8 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2025-34522 A heap-based buffer overflow vulnerability exists in the input parsing logic of... |
critical | 9.8 | — | Arcserve / udp | 2025-08-27 | 2026-10-23 |
| CVE-2025-6519 E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY... |
critical | 9.8 | — | Copeland / e3 supervisory controller firmware | 2025-09-02 | 2026-10-23 |
| CVE-2025-40594 A vulnerability has been identified in SINAMICS G220 V6.4 (All versions < V6.4 H... |
critical | 9.8 | — | Siemens / sinamics g220 firmware | 2025-09-09 | 2026-10-23 |
| CVE-2025-34282 ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulner... |
critical | 9.1 | — | Thingsboard / thingsboard | 2025-10-17 | 2026-10-23 |
| CVE-2025-11366 N-central < 2025.4 is vulnerable to authentication bypass via path traversal |
critical | 9.8 | — | N-able / n-central | 2025-11-12 | 2026-10-23 |
| CVE-2025-11367 The N-central Software Probe < 2025.4 is vulnerable to Remote Code Execution via... |
critical | 9.8 | — | N-able / n-central | 2025-11-12 | 2026-10-23 |
| CVE-2025-40938 A vulnerability has been identified in SIMATIC CN 4100 (All versions < V4.0.1). |
critical | 9.8 | — | Siemens / simatic cn 4100 firmware | 2025-12-09 | 2026-10-23 |
| CVE-2026-5300 Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unau... |
critical | 9.1 | — | Coolercontrol / coolercontrold | 2026-04-08 | 2026-10-23 |
| CVE-2026-46749 A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update... |
critical | 9.8 | — | Siemens / sinec ins | 2026-06-09 | 2026-10-23 |
| CVE-2026-48449 Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi... |
critical | 9.8 | — | Adobe / campaign | 2026-07-30 | 2026-10-23 |
| CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for... |
critical | 9.8 | — | Php / php | 2026-07-30 | 2026-10-23 |
| CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with s... |
critical | 9.8 | — | Php / php | 2026-07-30 | 2026-10-23 |
| CVE-2026-14522 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.... |
critical | 9.8 | — | Ibm / app connect enterprise | 2026-07-30 | 2026-10-23 |
| CVE-2026-4978 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
critical | 9.8 | — | — | 2026-07-30 | 2026-10-23 |
| CVE-2026-12118 IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated... |
critical | 9.8 | — | Ibm / webmethods integration | 2026-07-30 | 2026-10-23 |
| CVE-2026-66756 Improper Protection of Alternate Path vulnerability in Apache Tika. |
critical | 9.8 | — | Apache / tika | 2026-07-30 | 2026-10-23 |
| CVE-2026-67208 Juggle through 1.6.0 contains a remote code execution vulnerability that allows... |
critical | 9.8 | — | — | 2026-07-30 | 2026-10-23 |
| CVE-2026-18602 A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-41452 Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installe... |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-18614 A vulnerability was found in GL-iNet GL-MT3000 up to 4.4.5. |
critical | 9.8 | — | — | 2026-08-03 | 2026-10-23 |
| CVE-2026-68979 Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API me... |
critical | 9.8 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-68980 Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets... |
critical | 9.1 | — | Apache / nifi | 2026-08-03 | 2026-10-23 |
| CVE-2026-10025 IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 00... |
critical | 9.8 | — | Ibm / qradar security information and event manager | 2026-08-05 | 2026-10-23 |
| CVE-2026-17617 IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side... |
critical | 9.8 | — | Ibm / application gateway operator | 2026-08-05 | 2026-10-23 |
| CVE-2026-17556 A path traversal vulnerability was identified in GitHub Enterprise Server that a... |
critical | 9.1 | — | Github / enterprise server | 2026-08-05 | 2026-10-23 |
| CVE-2026-18847 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ha... |
critical | 9.8 | — | Ibm / i | 2026-08-12 | 2026-10-23 |
| CVE-2026-109122 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.1 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-107861 The system control service on affected Kiloview E3 NDI encoder firmware fails to... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-110243 The network management service on affected Kiloview E3 NDI encoder firmware fail... |
critical | 9.9 | — | — | 2026-10-22 | 2026-10-23 |
| CVE-2026-53942 Conda Organization Infrastructure is a centralized location for infrastructure c... |
critical | 9.9 | — | — | 2026-10-23 | 2026-10-23 |
| CVE-2026-109219 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in ve... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-23 |
| CVE-2026-13737 CommServe contained an allowlist bypass vulnerability affecting command executio... |
critical | 9.8 | — | Commvault / commvault | 2026-08-11 | 2026-10-23 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.