October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2024-7399 Samsung MagicINFO 9 Server Path Traversal Vulnerability |
critical | 9.8 | Listed | Samsung / MagicINFO 9 Server | 2024-08-12 | 2026-10-01 |
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overfl... |
critical | 9.0 | Listed | Ivanti / Connect Secure, Policy Secure, and ZTA Gateways | 2025-01-08 | 2026-10-01 |
| CVE-2021-22175 GitLab Server-Side Request Forgery (SSRF) Vulnerability |
critical | 9.8 | Listed | GitLab / GitLab | 2021-06-11 | 2026-10-01 |
| CVE-2026-58185 The Apache Traffic Server intercept plugin has a use-after-free. |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-58179 The Apache Traffic Server regex_remap plugin overflows the stack and integers fr... |
critical | 9.8 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-58163 Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr... |
critical | 9.1 | — | Apache / traffic server | 2026-07-29 | 2026-10-01 |
| CVE-2026-95284 Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 a... |
critical | 9.6 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-51866 In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/uplo... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51871 Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in sr... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-51856 In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes... |
critical | 9.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-81440 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81475 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Mis... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-81476 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Im... |
critical | 9.8 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-01 |
| CVE-2026-82829 Hitachi Coding Software Suite contains a vulnerability related to Hidden Functio... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82824 Hitachi Coding Software Suite contains a vulnerability related to Path Traversal... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82825 Hitachi Coding Software Suite contains a vulnerability related to Missing Authen... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-82827 Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-co... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102793 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102361 mall4j through 4.0 contains a missing authentication vulnerability in the PUT /u... |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-101261 A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101264 A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. |
critical | 9.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2025-9925 A vulnerability was found in projectworlds Travel Management System 1.0. |
critical | 9.8 | — | Projectworlds / travel management system | 2025-09-03 | 2026-10-01 |
| CVE-2025-10079 A flaw has been found in PHPGurukul Small CRM 4.0. |
critical | 9.8 | — | Phpgurukul / small crm | 2025-09-08 | 2026-10-01 |
| CVE-2025-10808 A weakness has been identified in Campcodes Farm Management System 1.0. |
critical | 9.8 | — | Campcodes / farm management system | 2025-09-22 | 2026-10-01 |
| CVE-2026-92966 The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordP... |
critical | 9.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-79901 In deployments using BoKS keytab management, affected versions of boks_keytabmd... |
critical | 9.9 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-101076 A vulnerability was detected in Netcore NR289-GE 1.4.5102. |
critical | 10.0 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101037 A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. |
critical | 9.9 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-101000 A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. |
critical | 10.0 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-103244 ground-station versions before 0.8.0 contain an authentication bypass vulnerabil... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-96760 Authlib (v1.7.2 and below) contains a signature verification bypass vulnerabilit... |
critical | 9.8 | — | — | 2026-09-28 | 2026-10-01 |
| CVE-2026-75957 The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for Wor... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-15989 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103248 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
critical | 9.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102427 Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaS... |
critical | 10.0 | — | Ordasoft / joomla cck | 2026-09-30 | 2026-10-01 |
| CVE-2026-16272 Use of less trusted source vulnerability in PayTR Payment and Electronic Money I... |
critical | 9.1 | — | — | 2026-09-09 | 2026-10-01 |
| CVE-2026-101148 The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not pr... |
critical | 10.0 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-76722 Uncontrolled Format string vulnerabilities exist in the affected interface of HP... |
critical | 9.8 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76723 Buffer overflow vulnerabilities exist in the affected interface of HPE Networkin... |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-76724 A command injection vulnerability exists in CLI of the affected HPE Networking I... |
critical | 9.6 | — | — | 2026-09-29 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.