October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability |
critical | 9.8 | — | Microsoft / azure monitor | 2025-11-20 | 2026-10-18 |
| CVE-2025-64655 Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an... |
critical | 9.8 | — | Microsoft / dynamics omnichannel sdk storage containers | 2025-11-20 | 2026-10-18 |
| CVE-2025-64755 Claude Code is an agentic coding tool. |
critical | 9.8 | — | Anthropic / claude code | 2025-11-21 | 2026-10-18 |
| CVE-2025-41115 SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in Apri... |
critical | 9.8 | — | Grafana / grafana | 2025-11-21 | 2026-10-18 |
| CVE-2025-13544 A weakness has been identified in ashraf-kabir travel-agency up to 1f25aa03544bc... |
critical | 9.8 | — | Ashraf-kabir / travel-agency | 2025-11-23 | 2026-10-18 |
| CVE-2025-13546 A vulnerability was detected in ashraf-kabir travel-agency up to 1f25aa03544bc5f... |
critical | 9.8 | — | Ashraf-kabir / travel-agency | 2025-11-23 | 2026-10-18 |
| CVE-2025-13554 A security vulnerability has been detected in Campcodes Supplier Management Syst... |
critical | 9.8 | — | Campcodes / supplier management system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13555 A vulnerability was detected in Campcodes School File Management System 1.0. |
critical | 9.8 | — | Campcodes / school file management system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13556 A flaw has been found in Campcodes Online Polling System 1.0. |
critical | 9.8 | — | Campcodes / online polling system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13557 A vulnerability has been found in Campcodes Online Polling System 1.0. |
critical | 9.8 | — | Campcodes / online polling system | 2025-11-23 | 2026-10-18 |
| CVE-2025-13560 A vulnerability was found in SourceCodester Company Website CMS 1.0. |
critical | 9.8 | — | Torrahclef / company website cms | 2025-11-23 | 2026-10-18 |
| CVE-2025-65084 An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon,... |
critical | 9.8 | — | Ashlar / argon | 2025-11-25 | 2026-10-18 |
| CVE-2025-65085 A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, X... |
critical | 9.8 | — | Ashlar / argon | 2025-11-25 | 2026-10-18 |
| CVE-2025-64656 Out-of-bounds read in Application Gateway allows an unauthorized attacker to ele... |
critical | 9.8 | — | Microsoft / azure application gateway | 2025-11-26 | 2026-10-18 |
| CVE-2025-66250 Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Te... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66251 Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Te... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66253 Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telec... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66254 Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66255 Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica T... |
critical | 9.8 | — | Dbbroadcast / mozart next 3000 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66256 Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Tel... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66257 Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica T... |
critical | 9.1 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66259 Authenticated Root Remote Code Execution via improrer user input filtering in DB... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66261 Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Te... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66262 Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Tel... |
critical | 9.8 | — | Dbbroadcast / mozart next 100 firmware | 2025-11-26 | 2026-10-18 |
| CVE-2025-66022 FACTION is a PenTesting Report Generation and Collaboration Framework. |
critical | 9.8 | — | Owasp / faction | 2025-11-26 | 2026-10-18 |
| CVE-2025-13797 A vulnerability was detected in ADSLR B-QE2W401 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13798 A flaw has been found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13799 A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2025-13800 A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. |
critical | 9.8 | — | Adslr / b-qe2w401 firmware | 2025-12-01 | 2026-10-18 |
| CVE-2026-73251 Mongoose is an embedded web server and network library. |
critical | 9.1 | — | Cesanta / mongoose | 2026-08-20 | 2026-10-18 |
| CVE-2026-73253 Mongoose is an embedded web server and network library. |
critical | 9.1 | — | Cesanta / mongoose | 2026-08-20 | 2026-10-18 |
| CVE-2026-77638 Tor before 0.4.9.11 is prone to a race condition where in just the right circums... |
critical | 9.0 | — | Torproject / tor | 2026-08-20 | 2026-10-18 |
| CVE-2026-62834 Improper verification of cryptographic signature in Azure Data Factory allows an... |
critical | 9.8 | — | Microsoft / azure data factory | 2026-08-20 | 2026-10-18 |
| CVE-2026-77642 tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus... |
critical | 9.3 | — | Torproject / tor | 2026-08-20 | 2026-10-18 |
| CVE-2025-66034 fontTools is a library for manipulating fonts, written in Python. |
critical | 9.8 | — | Fonttools / fonttools | 2025-11-29 | 2026-10-18 |
| CVE-2025-13783 A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44ee... |
critical | 9.8 | — | Wtcms Project / wtcms | 2025-11-30 | 2026-10-18 |
| CVE-2025-13786 A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2... |
critical | 9.8 | — | Wtcms Project / wtcms | 2025-11-30 | 2026-10-18 |
| CVE-2025-13787 A flaw has been found in ZenTao up to 21.7.6-8564. |
critical | 9.1 | — | Zentao / zentao | 2025-11-30 | 2026-10-18 |
| CVE-2025-13788 A vulnerability has been found in Chanjet CRM up to 20251106. |
critical | 9.8 | — | Chanjet / chanjet crm | 2025-11-30 | 2026-10-18 |
| CVE-2025-66405 Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. |
critical | 9.8 | — | Portkey / gateway | 2025-12-01 | 2026-10-18 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.