October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-9314 The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated a... |
critical | 9.8 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2025-71429 GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-12 | 2026-10-19 |
| CVE-2025-14989 A vulnerability was identified in Campcodes Complete Online Beauty Parlor Manage... |
critical | 9.8 | — | Campcodes / complete online beauty parlor management system | 2025-12-21 | 2026-10-19 |
| CVE-2025-14990 A security flaw has been discovered in Campcodes Complete Online Beauty Parlor M... |
critical | 9.8 | — | Campcodes / complete online beauty parlor management system | 2025-12-21 | 2026-10-19 |
| CVE-2025-15008 A vulnerability was detected in Tenda WH450 1.0.0.18. |
critical | 9.8 | — | Tenda / wh450 firmware | 2025-12-22 | 2026-10-19 |
| CVE-2025-15011 A vulnerability was found in code-projects Simple Stock System 1.0. |
critical | 9.8 | — | Carmelo / simple stock system | 2025-12-22 | 2026-10-19 |
| CVE-2025-12049 Missing Authentication for Critical Function vulnerability in Sharp Display Solu... |
critical | 9.8 | — | Sharp / mp-01 firmware | 2025-12-22 | 2026-10-19 |
| CVE-2025-15034 A security flaw has been discovered in itsourcecode Student Management System 1.... |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-23 | 2026-10-19 |
| CVE-2025-15048 A vulnerability was determined in Tenda WH450 1.0.0.18. |
critical | 9.8 | — | Tenda / wh450 firmware | 2025-12-23 | 2026-10-19 |
| CVE-2025-15049 A vulnerability was identified in code-projects Online Farm System 1.0. |
critical | 9.8 | — | Anisha / online farm system | 2025-12-23 | 2026-10-19 |
| CVE-2025-68665 LangChain is a framework for building LLM-powered applications. |
critical | 9.1 | — | Langchain / langchain.js | 2025-12-23 | 2026-10-19 |
| CVE-2026-109750 Site isolation issue in the DOM: Web Authentication component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-107083 SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulner... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111823 Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon en... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111998 Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-112292 CheckCle through 1.6.0 contains a missing authorization vulnerability that allow... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-112296 FlyCms through commit edfdf724 contains a default credentials vulnerability that... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109432 Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression i... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-108983 A vulnerability is in Web Server default connection ports under the process name... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-111058 Mercury is a Python framework for sharing Jupyter notebooks as web applications... |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability |
critical | 9.8 | Listed | Linux / Kernel | 2025-09-05 | 2026-10-19 |
| CVE-2026-109383 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-90910 Missing authentication for critical function vulnerability in Apache Answer. |
critical | 9.8 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-109829 undici is an HTTP client library for Node.js. |
critical | 9.1 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2026-67231 RabbitMQ is a messaging and streaming broker. |
critical | 9.1 | — | Broadcom / rabbitmq server | 2026-09-23 | 2026-10-19 |
| CVE-2026-83935 Heap-based buffer overflow in Microsoft XML allows an unauthorized attacker to e... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-78796 An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless route... |
critical | 9.8 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-23112 In the Linux kernel, the following vulnerability has been resolved:
nvmet-tcp:... |
critical | 9.8 | — | Linux / linux kernel | 2026-02-13 | 2026-10-19 |
| CVE-2026-110372 Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretri... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-104584 reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930c... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-110916 Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 all... |
critical | 9.6 | — | Google / chrome | 2026-10-15 | 2026-10-19 |
| CVE-2026-66786 A flaw was found in submariner. |
critical | 9.1 | — | — | 2026-09-02 | 2026-10-19 |
| CVE-2026-100800 Sandbox escape due to use-after-free in the Disability Access APIs component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100788 Invalid pointer in the JavaScript: WebAssembly component. |
critical | 9.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-111406 Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Ligh... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-110887 Improper Control of Generation of Code ('Code Injection') vulnerability in HiveP... |
critical | 9.9 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-102608 ZoneMinder is a free, open source closed-circuit television software application... |
critical | 9.0 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2025-58068 Eventlet is a concurrent networking library for Python. |
critical | 9.1 | — | Eventlet / eventlet | 2025-08-29 | 2026-10-19 |
| CVE-2025-9772 A vulnerability was detected in RemoteClinic up to 2.0. |
critical | 9.8 | — | Remoteclinic / remote clinic | 2025-09-01 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.