October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-66410 Gin-vue-admin is a backstage management system based on vue and gin. |
critical | 9.1 | — | Gin-vue-admin Project / gin-vue-admin | 2025-12-01 | 2026-10-18 |
| CVE-2025-66409 ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. |
critical | 9.1 | — | Espressif / esp-idf | 2025-12-02 | 2026-10-18 |
| CVE-2025-66489 Cal.com is open-source scheduling software. |
critical | 9.8 | — | Cal / cal.com | 2025-12-03 | 2026-10-18 |
| CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability |
critical | 10.0 | Listed | Meta / React Server Components | 2025-12-03 | 2026-10-18 |
| CVE-2025-13390 The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass... |
critical | 9.8 | — | Wpdirectorykit / wp directory kit | 2025-12-03 | 2026-10-18 |
| CVE-2025-64443 MCP Gateway allows easy and secure running and deployment of MCP servers. |
critical | 9.6 | — | Docker / mcp gateway | 2025-12-03 | 2026-10-18 |
| CVE-2025-66222 DeepChat is a smart assistant uses artificial intelligence. |
critical | 9.6 | — | Thinkinai / deepchat | 2025-12-03 | 2026-10-18 |
| CVE-2025-64081 SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester P... |
critical | 9.8 | — | Pamzey / patients waiting area queue management system | 2025-12-08 | 2026-10-18 |
| CVE-2025-14015 A weakness has been identified in H3C Magic B0 up to 100R002. |
critical | 9.8 | — | H3c / magic b0 firmware | 2025-12-04 | 2026-10-18 |
| CVE-2025-66576 Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system command... |
critical | 9.8 | — | Remotecontrolio / remote keyboard desktop | 2025-12-04 | 2026-10-18 |
| CVE-2025-66509 LaraDashboard is an all-In-one solution to start a Laravel Application. |
critical | 9.8 | — | Laradashboard / lara dashboard | 2025-12-04 | 2026-10-18 |
| CVE-2026-18516 An output escaping vulnerability in the Audit Logs component of Crafty Controlle... |
critical | 9.6 | — | — | 2026-10-16 | 2026-10-18 |
| CVE-2025-14093 A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. |
critical | 9.8 | — | Edimax / br-6478ac v3 firmware | 2025-12-05 | 2026-10-18 |
| CVE-2025-14094 A flaw has been found in Edimax BR-6478AC V3 1.0.15. |
critical | 9.8 | — | Edimax / br-6478ac v3 firmware | 2025-12-05 | 2026-10-18 |
| CVE-2026-109321 Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth... |
critical | 9.1 | — | — | 2026-10-12 | 2026-10-18 |
| CVE-2026-108707 Wukong_HRM through commit 186115e contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-11 | 2026-10-18 |
| CVE-2025-12515 Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: t... |
critical | 9.8 | — | Azure-access / blu-ic4 firmware | 2025-10-30 | 2026-10-18 |
| CVE-2025-12516 Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: thro... |
critical | 9.8 | — | Azure-access / blu-ic2 firmware | 2025-10-30 | 2026-10-18 |
| CVE-2012-10063 Nagios XI versions prior to 2012R1.3 contain a SQL injection vulnerability in th... |
critical | 9.8 | — | Nagios / nagios xi | 2025-10-30 | 2026-10-18 |
| CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability |
critical | 9.8 | Listed | BeyondTrust / Remote Support | 2026-10-15 | 2026-10-17 |
| CVE-2026-101950 A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-17 |
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-63146 Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w... |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-55562 Cronicle is a multi-server task scheduler and runner, with a web based front-end... |
critical | 9.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-100133 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-74040 Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln... |
critical | 9.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-53709 MCP Context Forge is an MCP gateway and administrative platform. |
critical | 9.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111711 Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111626 Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111641 FastapiAdmin through 3.0 contains an authentication bypass vulnerability that al... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109108 A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-102692 RIOT is an open-source microcontroller operating system designed for Internet of... |
critical | 9.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-105903 ColdFusion is affected by an Improper Control of Generation of Code ('Code Injec... |
critical | 9.9 | — | Adobe / coldfusion | 2026-10-13 | 2026-10-16 |
| CVE-2026-76285 As part of Cisco's ongoing commitment to proactive security and product quality,... |
critical | 9.8 | — | Splunk / splunk | 2026-10-07 | 2026-10-16 |
| CVE-2026-111673 IceCMS through 4.1.5 contains a missing authentication vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111687 WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability t... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111692 DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerabili... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111708 WhaTicket Community through commit cf04795 contains an authentication bypass vul... |
critical | 9.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-111322 Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability tha... |
critical | 9.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-111235 An authorization bypass vulnerability exists in the REST API of multiple version... |
critical | 9.1 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.