October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,932
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,242
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-14508 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.1 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14888 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14988 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-14992 IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.... |
critical | 9.8 | — | Ibm / datapower gateway | 2026-10-08 | 2026-10-14 |
| CVE-2026-97657 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Aut... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-91013 Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability... |
critical | 9.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109412 An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2022-48522 In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that... |
critical | 9.8 | — | Perl / perl | 2023-08-22 | 2026-10-14 |
| CVE-2025-43936 Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Au... |
critical | 9.1 | — | Dell / objectscale | 2026-09-16 | 2026-10-14 |
| CVE-2025-59953 LMDeploy is a toolkit for compressing, deploying, and serving large language mod... |
critical | 9.8 | — | — | 2026-09-16 | 2026-10-14 |
| CVE-2025-15002 A vulnerability has been found in SeaCMS up to 13.3. |
critical | 9.8 | — | Seacms / seacms | 2025-12-21 | 2026-10-14 |
| CVE-2025-59389 An SQL injection vulnerability has been reported to affect Hyper Data Protector. |
critical | 9.8 | — | Qnap / hyper data protector | 2026-01-02 | 2026-10-14 |
| CVE-2025-65110 Vega is a visualization grammar, a declarative format for creating, saving, and... |
critical | 9.3 | — | Vega Project / vega | 2026-01-05 | 2026-10-14 |
| CVE-2025-68705 RustFS is a distributed object storage system built in Rust. |
critical | 9.8 | — | Rustfs / rustfs | 2026-01-07 | 2026-10-14 |
| CVE-2026-102428 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joom... |
critical | 9.8 | — | Ordasoft / joomla cck | 2026-10-05 | 2026-10-14 |
| CVE-2026-102780 Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and... |
critical | 9.8 | — | Techfry / tf content | 2026-10-05 | 2026-10-14 |
| CVE-2026-106358 Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a r... |
critical | 9.6 | — | Google / chrome | 2026-10-06 | 2026-10-14 |
| CVE-2026-83711 Authorization bypass through user-controlled key in Microsoft Azure Active Direc... |
critical | 10.0 | — | Microsoft / azure active directory b2c | 2026-09-03 | 2026-10-14 |
| CVE-2026-70352 Missing authentication for critical function in Azure AI Language allows an unau... |
critical | 10.0 | — | Microsoft / azure ai language authoring | 2026-09-03 | 2026-10-14 |
| CVE-2026-93388 The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnera... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-108894 A security flaw has been discovered in Linksys E1700 1.0.0.4.003. |
critical | 9.9 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2022-37434 zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in infl... |
critical | 9.8 | — | Zlib / zlib | 2022-08-05 | 2026-10-14 |
| CVE-2022-37454 The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer ove... |
critical | 9.8 | — | Extended Keccak Code Package Project / extended keccak code package | 2022-10-21 | 2026-10-14 |
| CVE-2025-15399 IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0... |
critical | 10.0 | — | — | 2026-09-18 | 2026-10-14 |
| CVE-2026-56590 HCL BigFix Service Management is affected by an Unrestricted File Upload vulnera... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-56592 HCL BigFix Service Management is affected by an Improper Authentication validati... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-21806 HCL BigFix Service Management is affected by an Administrative Session Concurren... |
critical | 9.8 | — | Hcltech / bigfix service management | 2026-09-18 | 2026-10-14 |
| CVE-2026-110130 Dockhand before 1.0.45 contains an authentication bypass in which the global aut... |
critical | 10.0 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107779 Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains... |
critical | 9.8 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2022-32207 When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes... |
critical | 9.8 | — | Haxx / curl | 2022-07-07 | 2026-10-14 |
| CVE-2022-32221 When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`... |
critical | 9.8 | — | Haxx / curl | 2022-12-05 | 2026-10-14 |
| CVE-2022-29155 In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerabil... |
critical | 9.8 | — | Openldap / openldap | 2022-05-04 | 2026-10-14 |
| CVE-2022-28321 The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentica... |
critical | 9.8 | — | Linux-pam / linux-pam | 2022-09-19 | 2026-10-14 |
| CVE-2022-25236 xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert names... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-16 | 2026-10-14 |
| CVE-2022-25315 In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNa... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-18 | 2026-10-14 |
| CVE-2025-62718 Axios is a promise based HTTP client for the browser and Node.js. |
critical | 9.9 | — | Axios / axios | 2026-04-09 | 2026-10-14 |
| CVE-2022-25235 xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of e... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-02-16 | 2026-10-14 |
| CVE-2022-23852 Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer... |
critical | 9.8 | — | Libexpat Project / libexpat | 2022-01-24 | 2026-10-14 |
| CVE-2022-23218 The deprecated compatibility function svcunix_create in the sunrpc module of the... |
critical | 9.8 | — | Gnu / glibc | 2022-01-14 | 2026-10-14 |
| CVE-2022-23219 The deprecated compatibility function clnt_create in the sunrpc module of the GN... |
critical | 9.8 | — | Gnu / glibc | 2022-01-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.