October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85435 MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE... |
critical | 9.1 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85434 MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity b... |
critical | 9.1 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2023-28531 ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the inten... |
critical | 9.8 | — | Openbsd / openssh | 2023-03-17 | 2026-10-14 |
| CVE-2023-25139 sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds w... |
critical | 9.8 | — | Gnu / glibc | 2023-02-03 | 2026-10-14 |
| CVE-2023-23914 A cleartext transmission of sensitive information vulnerability exists in curl |
critical | 9.1 | — | Haxx / curl | 2023-02-23 | 2026-10-14 |
| CVE-2025-14191 A vulnerability has been found in UTT 进取 512W up to 1.7.7-171114. |
critical | 9.8 | — | Utt / 512w firmware | 2025-12-07 | 2026-10-14 |
| CVE-2025-14199 A flaw has been found in Verysync 微力同步 up to 2.21.3. |
critical | 9.8 | — | Verysync / verysync | 2025-12-07 | 2026-10-14 |
| CVE-2026-57090 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
critical | 9.8 | — | Microsoft / windows 10 1607 | 2026-07-14 | 2026-10-14 |
| CVE-2023-0687 A vulnerability was found in GNU C Library 2.38. |
critical | 9.8 | — | Gnu / glibc | 2023-02-06 | 2026-10-14 |
| CVE-2025-66567 The ruby-saml library is for implementing the client side of a SAML authorizatio... |
critical | 9.1 | — | Onelogin / ruby-saml | 2025-12-09 | 2026-10-14 |
| CVE-2025-66568 The ruby-saml library implements the client side of an SAML authorization. |
critical | 9.1 | — | Onelogin / ruby-saml | 2025-12-09 | 2026-10-14 |
| CVE-2025-64672 Improper neutralization of input during web page generation ('cross-site scripti... |
critical | 9.0 | — | Microsoft / sharepoint server | 2025-12-09 | 2026-10-14 |
| CVE-2025-14334 A flaw has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14335 A vulnerability has been found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14336 A vulnerability was found in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-14337 A vulnerability was determined in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-09 | 2026-10-14 |
| CVE-2025-64113 Emby Server is a user-installable home media server. |
critical | 9.8 | — | Emby / emby | 2025-12-09 | 2026-10-14 |
| CVE-2025-66456 Elysia is a Typescript framework for request validation, type inference, OpenAPI... |
critical | 9.8 | — | Elysiajs / elysia | 2025-12-09 | 2026-10-14 |
| CVE-2025-14087 A flaw was found in GLib (Gnome Lib). |
critical | 9.8 | — | Gnome / glib | 2025-12-10 | 2026-10-14 |
| CVE-2025-34392 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-34393 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-34394 Barracuda Service Center, as implemented in the RMM solution, in versions prior... |
critical | 9.8 | — | Barracuda / rmm | 2025-12-10 | 2026-10-14 |
| CVE-2025-14518 A vulnerability was identified in PowerJob up to 5.1.2. |
critical | 9.8 | — | Powerjob / powerjob | 2025-12-11 | 2026-10-14 |
| CVE-2025-65474 An arbitrary file rename vulnerability in the /admin/manager.php component of Ea... |
critical | 9.8 | — | Easyimages2.0 Project / easyimages2.0 | 2025-12-11 | 2026-10-14 |
| CVE-2026-84246 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-75875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-80381 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-81932 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82895 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-82900 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to d... |
critical | 9.1 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84035 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84057 IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to e... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-84058 IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer over... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-14 |
| CVE-2026-70300 Untrusted pointer dereference in Microsoft Office Word allows an unauthorized at... |
critical | 9.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability |
critical | 9.8 | Listed | Nx / Nx Console | 2026-05-27 | 2026-10-14 |
| CVE-2025-64721 Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT... |
critical | 10.0 | — | Sandboxie-plus / sandboxie | 2025-12-11 | 2026-10-14 |
| CVE-2026-8751 A security flaw has been discovered in h2oai h2o-3 up to 7402. |
critical | 9.8 | — | H2o / h2o | 2026-05-17 | 2026-10-14 |
| CVE-2026-8757 A vulnerability was found in adenhq hive up to 0.11.0. |
critical | 9.1 | — | Adenhq / hive | 2026-05-17 | 2026-10-14 |
| CVE-2026-45495 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
critical | 9.8 | — | Microsoft / edge chromium | 2026-05-18 | 2026-10-14 |
| CVE-2026-7876 IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication b... |
critical | 9.1 | — | Ibm / aspera high-speed transfer server for cloud pak for integration | 2026-05-27 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.