October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,919
Critical
3,121
High
7,058
Medium
6,893
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-107127 The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validat... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107237 The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does n... |
high | 8.2 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-107506 The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the cap... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-109147 The WP Booking System WordPress plugin before 2.1.0.3 does not validate and esca... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-110523 The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-regist... |
high | 8.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanit... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111948 The User Profile Builder WordPress plugin before 4.0.1 does not escape the curre... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111949 The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending pass... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly deter... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not e... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does no... |
high | 8.6 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-85683 The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonc... |
high | 8.8 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-106573 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-111833 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111838 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111840 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-111848 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-112221 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-101469 Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply... |
high | 7.5 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-83867 Heap-based buffer overflow in Windows Push Notifications allows an authorized at... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83871 Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83872 Incorrect conversion between numeric types in Windows TCP/IP allows an authorize... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-113271 Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-83873 Relative path traversal in Windows Shell allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-83874 Heap-based buffer overflow in Windows Event Tracing allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-113338 Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-21 |
| CVE-2026-83876 Use after free in Windows Shell allows an authorized attacker to elevate privile... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-21 |
| CVE-2026-93442 IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package... |
high | 8.2 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-114245 A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5... |
high | 7.3 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-114085 Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the... |
high | 7.9 | — | — | 2026-10-21 | 2026-10-21 |
| CVE-2026-113704 A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. |
high | 7.3 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-113613 FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress... |
high | 8.1 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-100134 Acrobat for Edge is affected by an out-of-bounds write vulnerability that could... |
high | 8.8 | — | — | 2026-10-20 | 2026-10-21 |
| CVE-2026-106576 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106578 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106579 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 7.5 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-106580 ImageMagick is free and open-source software used for editing and manipulating d... |
high | 8.2 | — | Imagemagick / imagemagick | 2026-10-07 | 2026-10-21 |
| CVE-2026-83853 Use after free in Windows Hello allows an authorized attacker to elevate privile... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-21 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.