October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-109620 A vulnerability has been found in SourceCodester Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109901 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109605 A security vulnerability has been detected in SourceCodester Simple Cafe Billing... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104082 SmarterMail before build 9777 contains a remote code execution vulnerability tha... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-103367 The ShopMagic – email automation for WordPress plugin for WordPress is vulnerabl... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103307 The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107126 The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107508 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-s... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privi... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86799 The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xt... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-101294 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM We... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-73790 A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and sys... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73798 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-76655 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote c... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107390 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-14 |
| CVE-2026-103966 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103967 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104340 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104341 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104342 Adobe Framemaker is affected by a Use After Free vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104344 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103844 Dimension is affected by an out-of-bounds write vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103845 Dimension is affected by an Uncontrolled Search Path Element vulnerability that... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103846 Dimension is affected by an Improper Neutralization of Input During Web Page Gen... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103847 Dimension is affected by an Untrusted Search Path vulnerability that could resul... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103854 Dimension is affected by a Stack-based Buffer Overflow vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100127 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100128 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100129 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-85431 MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packe... |
high | 7.5 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-97398 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-95808 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109519 A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109523 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103422 The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100153 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85429 MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the m... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.