October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,928
Critical
3,121
High
7,064
Medium
6,896
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-112904 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.7 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-106764 An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbit... |
high | 7.5 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-110541 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2025-45528 An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local at... |
high | 7.3 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-103779 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2024-58393 i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQ... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2022-51023 PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows... |
high | 8.2 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-97019 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86377 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-75891 The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Obj... |
high | 8.8 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-25716 Missing Authorization vulnerability in Hallo Welt! |
high | 7.1 | — | — | 2026-10-23 | 2026-10-29 |
| CVE-2026-116839 A malicious actor who lures an authenticated user to a malicious page could expl... |
high | 7.1 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-1928 The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress i... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-15323 The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-115417 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adap... |
high | 7.5 | — | — | 2026-10-22 | 2026-10-29 |
| CVE-2026-115807 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.1 | — | — | 2026-10-24 | 2026-10-29 |
| CVE-2026-116613 The Animated Text Block plugin for WordPress is vulnerable to Sensitive Informat... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111820 The Analytics Insights – Google Analytics Dashboard for WordPress plugin for Wor... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-111314 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111111 The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Ad... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110662 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-109995 The Advanced Views – Display Framework for Gutenberg & Elementor plugin for Word... |
high | 7.2 | — | — | 2026-10-27 | 2026-10-29 |
| CVE-2026-109384 The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103410 An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Netw... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-101583 Vulnerability in the Helidon product of Oracle Fusion Middleware (component: hel... |
high | 7.0 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-101593 Vulnerability in the Oracle Agile Product Lifecycle Management for Process produ... |
high | 8.3 | — | — | 2026-10-20 | 2026-10-29 |
| CVE-2026-0631 An OS Command Injection vulnerability exists in the Surfshark VPN login function... |
high | 8.0 | — | Tp-link / archer be230 firmware | 2026-02-02 | 2026-10-28 |
| CVE-2023-54404 Zod schema-validation library contains an uncontrolled resource consumption vuln... |
high | — | — | — | 2026-10-01 | 2026-10-28 |
| CVE-2026-93631 A cross-site request forgery vulnerability in the OAuth extension of Zimbra Coll... |
high | 7.1 | — | Synacor / zimbra collaboration suite | 2026-10-23 | 2026-10-28 |
| CVE-2026-91260 Vulnerability in the iProcurement product of Oracle E-Business Suite (component:... |
high | 7.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91242 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugin... |
high | 7.4 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91252 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91253 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel... |
high | 7.8 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-91256 Vulnerability in the Oracle Solaris product of Oracle Systems (component: Servic... |
high | 7.1 | — | — | 2026-10-20 | 2026-10-28 |
| CVE-2026-70341 Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker... |
high | 8.8 | — | Microsoft / edge | 2026-09-11 | 2026-10-28 |
| CVE-2026-70354 Out-of-bounds write in .NET allows an unauthorized attacker to execute code loca... |
high | 7.8 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62886 Integer overflow or wraparound in .NET allows an unauthorized attacker to elevat... |
high | 7.8 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62898 Use after free in Microsoft QUIC allows an unauthorized attacker to disclose inf... |
high | 7.5 | — | Microsoft / visual studio 2022 | 2026-08-11 | 2026-10-28 |
| CVE-2026-62871 Out-of-bounds write in .NET allows an unauthorized attacker to execute code loca... |
high | 7.8 | — | Microsoft / .net | 2026-08-11 | 2026-10-28 |
| CVE-2026-62752 Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-08-11 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.