October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-9775 A vulnerability was found in RemoteClinic up to 2.0. |
critical | 9.8 | — | Remoteclinic / remote clinic | 2025-09-01 | 2026-10-19 |
| CVE-2025-57807 ImageMagick is free and open-source software used for editing and manipulating d... |
critical | 9.8 | — | Imagemagick / imagemagick | 2025-09-05 | 2026-10-19 |
| CVE-2025-58448 rAthena is an open-source cross-platform massively multiplayer online role playi... |
critical | 9.8 | — | Rathena / rathena | 2025-09-09 | 2026-10-19 |
| CVE-2025-58750 rAthena is an open-source cross-platform massively multiplayer online role playi... |
critical | 9.1 | — | Rathena / rathena | 2025-09-09 | 2026-10-19 |
| CVE-2025-10251 A vulnerability was detected in FoxCMS up to 1.24. |
critical | 9.8 | — | Foxcms / foxcms | 2025-09-11 | 2026-10-19 |
| CVE-2025-58045 Dataease is an open source data analytics and visualization platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
| CVE-2025-58046 Dataease is an open-source data visualization and analysis platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
| CVE-2025-58748 Dataease is an open source data analytics and visualization platform. |
critical | 9.8 | — | Dataease / dataease | 2025-09-15 | 2026-10-19 |
| CVE-2025-10662 A vulnerability has been found in SeaCMS up to 13.3. |
critical | 9.8 | — | Seacms / seacms | 2025-09-18 | 2026-10-19 |
| CVE-2026-109894 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110886 Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational F... |
critical | 9.8 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2025-59431 MapServer is a system for developing web-based GIS applications. |
critical | 9.8 | — | Osgeo / mapserver | 2025-09-19 | 2026-10-19 |
| CVE-2025-9642 An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 b... |
critical | 9.6 | — | Gitlab / gitlab | 2025-09-26 | 2026-10-19 |
| CVE-2025-54592 FreshRSS is a free, self-hostable RSS aggregator. |
critical | 9.8 | — | Freshrss / freshrss | 2025-09-29 | 2026-10-19 |
| CVE-2025-49844 Redis is an open source, in-memory database that persists on disk. |
critical | 9.9 | — | Redis / redis | 2025-10-03 | 2026-10-19 |
| CVE-2025-59944 Cursor is a code editor built for programming with AI. |
critical | 9.8 | — | Anysphere / cursor | 2025-10-03 | 2026-10-19 |
| CVE-2025-11344 A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11345 A flaw has been found in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11346 A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. |
critical | 9.8 | — | Ilias / ilias | 2025-10-06 | 2026-10-19 |
| CVE-2025-11529 A security flaw has been discovered in ChurchCRM up to 5.18.0. |
critical | 9.8 | — | Churchcrm / churchcrm | 2025-10-09 | 2026-10-19 |
| CVE-2025-11624 Potential stack buffer overwrite on the SFTP server side when receiving a malici... |
critical | 9.8 | — | Wolfssh / wolfssh | 2025-10-21 | 2026-10-19 |
| CVE-2025-11625 Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier... |
critical | 9.8 | — | Wolfssh / wolfssh | 2025-10-21 | 2026-10-19 |
| CVE-2025-62717 Emlog is an open source website building system. |
critical | 9.1 | — | Emlog / emlog | 2025-10-24 | 2026-10-19 |
| CVE-2026-100794 Sandbox escape due to incorrect boundary conditions in the Internationalization... |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-111911 phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability wher... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110653 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
critical | 9.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-104736 The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in ver... |
critical | 9.8 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-84015 Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TL... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-111690 Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-69883 Use after free in Windows iSCSI allows an unauthorized attacker to execute code... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-109745 Sandbox escape due to uninitialized memory in the DOM: Web Serial component. |
critical | 9.6 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2025-12480 Gladinet Triofox Improper Access Control Vulnerability |
critical | 9.1 | Listed | Gladinet / Triofox | 2025-11-10 | 2026-10-19 |
| CVE-2025-12268 A vulnerability has been found in LearnHouse up to 98dfad76aad70711a8113f6c1fdab... |
critical | 9.8 | — | Learnhouse / learnhouse | 2025-10-27 | 2026-10-19 |
| CVE-2025-64102 Zitadel is open-source identity infrastructure software. |
critical | 9.8 | — | Zitadel / zitadel | 2025-10-29 | 2026-10-19 |
| CVE-2025-64103 Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor aut... |
critical | 9.8 | — | Zitadel / zitadel | 2025-10-29 | 2026-10-19 |
| CVE-2025-11200 MLflow Weak Password Requirements Authentication Bypass Vulnerability. |
critical | 9.8 | — | Lfprojects / mlflow | 2025-10-29 | 2026-10-19 |
| CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution... |
critical | 9.8 | — | Lfprojects / mlflow | 2025-10-29 | 2026-10-19 |
| CVE-2025-12642 lighttpd1.4.80 incorrectly merged trailer fields into headers after http request... |
critical | 9.1 | — | Lighttpd / lighttpd | 2025-11-03 | 2026-10-19 |
| CVE-2025-47776 Mantis Bug Tracker (MantisBT) is an open source issue tracker. |
critical | 9.1 | — | Mantisbt / mantisbt | 2025-11-04 | 2026-10-19 |
| CVE-2025-62161 Youki is a container runtime written in Rust. |
critical | 10.0 | — | Youki-dev / youki | 2025-11-06 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.