CVE Tools
Track your stack

October/october

12 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for October/october, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

October/october CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
October/october CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-051
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-091
2026-100

Severity

How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical110%
  • High440%
  • Medium550%

Latest CVEs

The 12 most recently published vulnerabilities affecting October/october.

  1. GHSA-2xmm-m4wv-3fjhOctober CMS: Incomplete Scheme Validation in Image Resizer—
  2. CVE-2024-51991October CMS Allows Unprotected SVG Rename in Media Manager4.9
  3. CVE-2024-45962October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cro...4.7
  4. CVE-2023-25365Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp37.8
  5. CVE-2023-37692An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.5.4
  6. CVE-2021-41126Deleted Admin Can Sign In to Admin Interface7.2
  7. GHSA-v73w-r9xg-7cr9Use of insecure jQuery version in OctoberCMS—
  8. CVE-2018-1999009October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in modules/system/traits/ViewMaker.php#244 (makeFileContents function) that can result in Sensitive information ...8.1
  9. CVE-2017-1000193October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand logo image name resulting in JavaScript code execution in the victim's browser.6.1
  10. CVE-2017-1000194October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.9.8
  11. CVE-2017-16244Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's ...8.8
  12. CVE-2015-5612Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.4.3

Product grouping is registry-driven, with AI assist and human review. How it works