October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,672
Critical
3,114
High
7,020
Medium
6,795
Low
599
Severity not reported
4,144
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-93565 A flaw was found in Netty RtspDecoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-83592 The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-88043 The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-81534 The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77114 The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre... |
high | 8.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untruste... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the rep... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110284 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108480 Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploit... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108483 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108484 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107910 An improper authentication vulnerability in the is_authenticated function (src/b... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107631 The Record of Consent Extension for Complianz plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107751 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105874 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107421 Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhi... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104939 Description
NGINX Ingress Controller has a vulnerability when implementing an ex... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104767 The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104764 The Post Export Import with Media plugin for WordPress is vulnerable to PHP Obje... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102562 The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-103366 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103358 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103081 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102986 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102251 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to gen... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-100351 kin-openapi is a Go project for handling OpenAPI files. |
high | 7.4 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-84875 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 8.8 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-84891 IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker... |
high | 7.5 | — | Ibm / guardium data protection | 2026-10-08 | 2026-10-15 |
| CVE-2026-73594 Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16,... |
high | 8.8 | — | Dell / policy manager for secure connect gateway | 2026-09-29 | 2026-10-15 |
| CVE-2026-83535 A flaw was found in openstack-network-exporter. |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-85971 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-15 |
| CVE-2026-85972 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 1... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.