October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,797
Critical
3,115
High
7,036
Medium
6,844
Low
605
Severity not reported
4,197
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109193 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-109224 The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downlo... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107758 The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107764 The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107768 The TranslatePress – Translate Multilingual sites with AI Translation plugin for... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107648 The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attac... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-105065 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-104745 The Customer Email Verification for WooCommerce plugin for WordPress is vulnerab... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-104932 The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in v... |
high | 8.0 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103525 The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103896 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-103999 The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-102052 A Stack-based Buffer Overflow vulnerability in the jdhcpd process of Juniper Net... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102055 A Stack-based Buffer Overflow vulnerability in the cfmd process of Juniper Netwo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102059 An Improper Neutralization of Special Elements used in an OS Command ('OS Comman... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102061 A Stack-based Buffer Overflow vulnerability in the phone-home daemon (phcd) of J... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102174 A Stack-based Buffer Overflow vulnerability in the iked IKE key-management daemo... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101997 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102014 A Stack-based Buffer Overflow vulnerability in the authd process of Juniper Netw... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102015 A Heap-based Buffer Overflow vulnerability in the secure-dot1xd process of Junip... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-102049 A Stack-based Buffer Overflow vulnerability in the l2cpd process of Juniper Netw... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101927 A Heap-based Buffer Overflow vulnerability in eventd of Juniper Networks Junos O... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101955 A Stack-based Buffer Overflow vulnerability in the UTM Anti-Spam SBL of Juniper... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101978 An OS Command Injection vulnerability in the bootzd zero-touch provisioning daem... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-101981 A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-100186 The User Profile Builder – Beautiful User Registration Forms, User Profiles & Us... |
high | 7.2 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96215 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-16 |
| CVE-2026-110108 MateCloud through 5.0.8 contains a missing authorization vulnerability that allo... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110115 Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal v... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-110119 Yshopmall through 2.0.0 contains an insecure direct object reference vulnerabili... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111311 The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, B... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-96044 No cwe for this issue in Microsoft Office SharePoint allows an authorized attack... |
high | 8.8 | — | Microsoft / sharepoint server | 2026-10-13 | 2026-10-16 |
| CVE-2026-70213 Origin validation error in Microsoft Power Apps allows an authorized attacker to... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-62840 Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an auth... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11731 An authentication bypass vulnerability in the listed NETGEAR RAX series models a... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-11732 An insufficient input validation vulnerability in the website blocking feature (... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-111391 SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluat... |
high | 8.1 | — | — | 2026-10-16 | 2026-10-16 |
| CVE-2026-100207 Improper neutralization of special elements used in an os command ('os command i... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-16 |
| CVE-2026-13043 A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMA... |
high | 8.8 | — | Watchguard / endpoint security | 2026-10-01 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.