October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,894
Critical
3,119
High
7,046
Medium
6,884
Low
606
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107762 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-103899 The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-108123 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitra... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for Wo... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110889 Generation of Error Message Containing Sensitive Information vulnerability in Ga... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109895 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110383 Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110895 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-84012 Double free in Remote Desktop Gateway Service allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84013 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84014 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84016 Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84017 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentic... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that a... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111685 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 contains an insecure direct obj... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows a... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111650 ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-84018 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84019 Use after free in Windows Advanced Rasterization Platform allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84020 Use after free in Windows Routing and Remote Access Service (RRAS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69880 Access of resource using incompatible type ('type confusion') in Desktop Window... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69882 Untrusted search path in Windows Update allows an authorized attacker to elevate... |
high | 7.8 | — | Microsoft / windows 11 23h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69991 Use after free in Remote Desktop Client allows an unauthorized attacker to execu... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-41582 countly-server is the server-side part of Countly, a product analytics solution. |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-77474 destructive_command_guard (dcg) is a command-line safety tool that blocks destru... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111605 Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileCo... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-109746 Mitigation bypass in the DOM: Security component. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109747 Other issue in the Address Bar component. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109754 Incorrect boundary conditions in the DOM: Editor component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
| CVE-2026-109759 Site isolation issue in the Networking component. |
high | 8.1 | — | — | 2026-10-13 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.