October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,639
Critical
3,114
High
7,009
Medium
6,780
Low
599
Severity not reported
4,137
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70049 Improper neutralization of special elements used in an sql command ('sql injecti... |
high | 8.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105729 Untrusted pointer dereference in SysInternals allows an authorized attacker to e... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105732 Stack-based buffer overflow in SysInternals allows an authorized attacker to ele... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-105727 Improper limitation of a pathname to a restricted directory ('path traversal') i... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-103572 Improper control of generation of code ('code injection') in Visual Studio Tools... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-102232 Incorrect authorization in Visual Studio Code allows an unauthorized attacker to... |
high | 7.0 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100205 Untrusted pointer dereference in SysInternals allows an authorized attacker to e... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-85891 Exposure of sensitive information to an unauthorized actor in Azure HDInsight al... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-84319 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-83844 Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute c... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-83746 Absolute path traversal in Skype for Business and Microsoft Lync allows an autho... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70297 Absolute path traversal in Skype for Business and Microsoft Lync allows an autho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70343 Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unautho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70187 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100757 Use-after-free in the Widget component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-109201 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerabilit... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-74035 Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104752 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate th... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87780 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87781 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94256 The SMS Alert WordPress plugin before 4.0.1 does not verify that the account bei... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94257 The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose pass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103305 The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103694 The Mobile builder WordPress plugin through 1.4.2 does not properly restrict whi... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103695 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104680 The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user ho... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-106029 The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authori... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-14854 The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-su... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81420 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a param... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84258 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not san... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84259 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitis... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84260 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not s... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84261 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85126 The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks o... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86798 The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87760 The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or esca... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87761 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perfor... |
high | 8.0 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.