October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-83851 Heap-based buffer overflow in Windows Partition Management Driver allows an unau... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-93757 The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypa... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93855 The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL I... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93904 The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96228 SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypa... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96666 The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96669 The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96741 The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107743 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112827 Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Et... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114193 Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115592 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115599 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115611 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115963 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115965 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110184 The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the '... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115821 The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96767 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83852 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-112484 This issue was addressed with improved file handling. |
high | 7.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112457 A double free issue was addressed with improved memory management. |
high | 7.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112438 A logic issue was addressed with improved state management. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112427 An authentication issue was addressed with improved state management. |
high | 8.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object inject... |
high | 8.1 | — | Roundcube / webmail | 2026-10-22 | 2026-10-29 |
| CVE-2026-92158 F´ (F Prime) is a framework that enables development and deployment of spaceflig... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-73261 Mongoose is an embedded web server and network library. |
high | 7.5 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-61611 Lychee is a free, open-source photo-management tool. |
high | 7.5 | — | — | 2026-10-15 | 2026-10-29 |
| CVE-2026-55786 Flyto2 Core is an execution kernel for automation and AI-agent workflows. |
high | 8.4 | — | — | 2026-10-14 | 2026-10-29 |
| CVE-2026-56838 PraisonAI is a multi-agent teams system. |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57114 PraisonAI is a multi-agent teams system. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-57142 PraisonAI is a multi-agent teams system. |
high | 7.8 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-39902 Cacti is an open source performance and fault management framework. |
high | 7.2 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116391 Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116392 Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordi... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115606 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116389 Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.