October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2025-15420 A security vulnerability has been detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15421 A vulnerability was detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15424 A vulnerability was found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15425 A vulnerability was determined in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15434 A vulnerability was detected in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15435 A flaw has been found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-15436 A vulnerability has been found in Yonyou KSOA 9.0. |
critical | 9.8 | — | Yonyou / ksoa | 2026-01-02 | 2026-10-07 |
| CVE-2025-64121 Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvati... |
critical | 9.8 | — | Nuvationenergy / nplatform | 2026-01-02 | 2026-10-07 |
| CVE-2025-64123 Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Co... |
critical | 9.8 | — | Nuvationenergy / nplatform | 2026-01-02 | 2026-10-07 |
| CVE-2025-15115 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authenticat... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-3653 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper ac... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-3654 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information... |
critical | 9.8 | — | Petlibro / petlibro | 2026-01-04 | 2026-10-07 |
| CVE-2025-15448 A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf... |
critical | 9.8 | — | Cld378632668 / javamall | 2026-01-05 | 2026-10-07 |
| CVE-2025-15449 A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec94... |
critical | 9.1 | — | Cld378632668 / javamall | 2026-01-05 | 2026-10-07 |
| CVE-2025-15457 A vulnerability was found in bg5sbk MiniCMS up to 1.8. |
critical | 9.8 | — | 1234n / minicms | 2026-01-05 | 2026-10-07 |
| CVE-2025-15458 A vulnerability was determined in bg5sbk MiniCMS up to 1.8. |
critical | 9.8 | — | 1234n / minicms | 2026-01-05 | 2026-10-07 |
| CVE-2025-59467 A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices P... |
critical | 9.6 | — | Ui / argentina afip invoices | 2026-01-05 | 2026-10-07 |
| CVE-2025-55204 muffon is a cross-platform music streaming client for desktop. |
critical | 9.6 | — | Muffon / muffon | 2026-01-05 | 2026-10-07 |
| CVE-2025-68456 Craft is a platform for creating digital experiences. |
critical | 9.1 | — | Craftcms / craft cms | 2026-01-05 | 2026-10-07 |
| CVE-2025-14942 wolfSSH’s key exchange state machine can be manipulated to leak the client’s pas... |
critical | 9.8 | — | Wolfssh / wolfssh | 2026-01-06 | 2026-10-07 |
| CVE-2025-55125 This vulnerability allows a Backup or Tape Operator to perform remote code execu... |
critical | 9.8 | — | Veeam / veeam backup \& replication | 2026-01-08 | 2026-10-07 |
| CVE-2025-59468 This vulnerability allows a Backup Administrator to perform remote code executio... |
critical | 9.1 | — | Veeam / veeam backup \& replication | 2026-01-08 | 2026-10-07 |
| CVE-2025-15480 In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user cr... |
critical | 9.1 | — | Canonical / ubuntu desktop provision | 2026-04-09 | 2026-10-07 |
| CVE-2025-31991 Rate Limiting for attempting a user login is not being properly enforced, making... |
critical | 9.8 | — | Hcltech / devops velocity | 2026-04-13 | 2026-10-07 |
| CVE-2025-15625 Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Clou... |
critical | 9.8 | — | Sparxsystems / pro cloud server | 2026-04-17 | 2026-10-07 |
| CVE-2025-14543 Improper Restriction of XML External Entity Reference vulnerability in RTI Conne... |
critical | 9.1 | — | Rti / connext professional | 2026-04-30 | 2026-10-07 |
| CVE-2025-59851 HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities fl... |
critical | 9.8 | — | Hcltech / dfxanalytics | 2026-05-06 | 2026-10-07 |
| CVE-2025-59852 HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulne... |
critical | 9.1 | — | Hcltech / dfxanalytics | 2026-05-06 | 2026-10-07 |
| CVE-2025-40639 A SQL injection vulnerability has been found in Eventobot. |
critical | 9.8 | — | Sbitsoft / eventobot | 2026-03-09 | 2026-10-07 |
| CVE-2025-13392 Improper check for unusual or exceptional conditions vulnerability in SSO in Syn... |
critical | 9.8 | — | Synology / diskstation manager | 2026-05-27 | 2026-10-07 |
| CVE-2026-91140 An OS command injection vulnerability in the shell-based temporary-file cleanup... |
critical | 9.6 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-55330 In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-105135 A vulnerability has been found in InternLM MindSearch 0.1.0. |
critical | 10.0 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-35053 OneUptime is an open-source monitoring and observability platform. |
critical | 9.8 | — | Hackerbay / oneuptime | 2026-04-02 | 2026-10-06 |
| CVE-2026-31818 Budibase is an open-source low-code platform. |
critical | 9.9 | — | Budibase / budibase | 2026-04-03 | 2026-10-06 |
| CVE-2026-35477 InvenTree is an Open Source Inventory Management System. |
critical | 9.9 | — | Inventree Project / inventree | 2026-04-08 | 2026-10-06 |
| CVE-2025-59872 HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the... |
critical | 9.8 | — | Hcltech / zie for web | 2026-06-17 | 2026-10-06 |
| CVE-2026-18162 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18163 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.8 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
| CVE-2026-18169 IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remot... |
critical | 9.9 | — | Ibm / financial transaction manager | 2026-09-22 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.