October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-14330 JIT miscompilation in the JavaScript Engine: JIT component. |
critical | 9.8 | — | Mozilla / firefox | 2025-12-09 | 2026-10-07 |
| CVE-2025-66565 Fiber Utils is a collection of common functions created for Fiber. |
critical | 9.8 | — | Gofiber / utils | 2025-12-09 | 2026-10-07 |
| CVE-2025-66631 CSLA .NET is a framework designed for the development of reusable, object-orient... |
critical | 9.8 | — | Cslanet / csla .net | 2025-12-09 | 2026-10-07 |
| CVE-2025-67504 WBCE CMS is a content management system. |
critical | 9.8 | — | Wbce / wbce cms | 2025-12-09 | 2026-10-07 |
| CVE-2025-14520 A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acb... |
critical | 9.1 | — | Baowzh / hfly | 2025-12-11 | 2026-10-07 |
| CVE-2025-14522 A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1... |
critical | 9.8 | — | Baowzh / hfly | 2025-12-11 | 2026-10-07 |
| CVE-2025-14527 A weakness has been identified in projectworlds Advanced Library Management Syst... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-14529 A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. |
critical | 9.8 | — | Campcodes / retro basketball shoes online store | 2025-12-11 | 2026-10-07 |
| CVE-2025-14536 A security flaw has been discovered in code-projects Class and Exam Timetable Ma... |
critical | 9.8 | — | Fabian / class and exam timetable management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-36937 In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible o... |
critical | 9.8 | — | Google / android | 2025-12-11 | 2026-10-07 |
| CVE-2025-14537 A weakness has been identified in code-projects Class and Exam Timetable Managem... |
critical | 9.8 | — | Fabian / class and exam timetable management system | 2025-12-11 | 2026-10-07 |
| CVE-2025-66588 In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized poi... |
critical | 9.8 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66589 In AzeoTech DAQFactory release 20.7 (Build 2555), an Out-of-bounds Read vulnerab... |
critical | 9.1 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66590 In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnera... |
critical | 9.8 | — | Azeotech / daqfactory | 2025-12-11 | 2026-10-07 |
| CVE-2025-66419 MaxKB is an open-source AI assistant for enterprise. |
critical | 10.0 | — | Maxkb / maxkb | 2025-12-11 | 2026-10-07 |
| CVE-2025-67727 Parse Server is an open source backend that can be deployed to any infrastructur... |
critical | 9.8 | — | Parseplatform / parse-server | 2025-12-12 | 2026-10-07 |
| CVE-2025-54947 In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability invo... |
critical | 9.8 | — | Apache / streampark | 2025-12-12 | 2026-10-07 |
| CVE-2025-14565 A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-12-12 | 2026-10-07 |
| CVE-2025-14566 A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd89... |
critical | 9.8 | — | Kidaze / courseselectionsystem | 2025-12-12 | 2026-10-07 |
| CVE-2025-14570 A flaw has been found in projectworlds Advanced Library Management System 1.0. |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14571 A vulnerability has been found in projectworlds Advanced Library Management Syst... |
critical | 9.8 | — | Projectworlds / advanced library management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14578 A weakness has been identified in itsourcecode Student Management System 1.0. |
critical | 9.8 | — | Angeljudesuarez / student management system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14583 A flaw has been found in campcodes Online Student Enrollment System 1.0. |
critical | 9.8 | — | Campcodes / online student enrollment system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14584 A vulnerability has been found in itsourcecode COVID Tracking System 1.0. |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-12 | 2026-10-07 |
| CVE-2025-14585 A vulnerability was found in itsourcecode COVID Tracking System 1.0. |
critical | 9.8 | — | Angeljudesuarez / covid tracking system | 2025-12-12 | 2026-10-07 |
| CVE-2026-9082 Drupal Core SQL Injection Vulnerability |
critical | 9.8 | Listed | Drupal / Core | 2026-05-20 | 2026-10-07 |
| CVE-2026-97720 Incorrect implementation of JWT/OAuth authentication in Impala executors in Apac... |
critical | 9.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-76460 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability |
critical | 10.0 | Listed | Cisco / Identity Services Engine | 2026-09-16 | 2026-10-07 |
| CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability |
critical | 9.8 | Listed | LiteSpeed / cPanel Plugin | 2026-05-21 | 2026-10-07 |
| CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability |
critical | 10.0 | Listed | Ivanti / Sentry | 2026-06-09 | 2026-10-07 |
| CVE-2026-106446 Handlebars provides the power necessary to let users build semantic templates. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2021-21351 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.1 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21347 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21350 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21344 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21345 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.9 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21346 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.8 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2021-21342 XStream is a Java library to serialize objects to XML and back again. |
critical | 9.1 | — | Netapp / oncommand insight | 2021-03-23 | 2026-10-07 |
| CVE-2019-17267 A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2... |
critical | 9.8 | — | Fasterxml / jackson-databind | 2019-10-07 | 2026-10-07 |
| CVE-2016-1000031 Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Cod... |
critical | 9.8 | — | Apache / commons fileupload | 2016-10-25 | 2026-10-07 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.