October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,606
Critical
3,110
High
6,989
Medium
6,776
Low
599
Severity not reported
4,132
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-84360 Nginx UI is a web user interface for the Nginx web server. |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-83742 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-106510 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-106556 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage | 2026-10-07 | 2026-10-13 |
| CVE-2026-106558 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-07 | 2026-10-13 |
| CVE-2026-107212 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107214 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107215 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107216 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107217 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107219 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-107223 Excelize is a Go language library for reading and writing Microsoft Excel spread... |
high | 7.5 | — | Excelize / excelize | 2026-10-07 | 2026-10-13 |
| CVE-2026-109960 Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109573 phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escap... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109616 Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing author... |
high | 7.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109114 A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108963 databasement before 1.8.2 allows remote code execution because it runs certain c... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-108956 A vulnerability was identified in code-projects Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108965 A vulnerability was determined in SourceCodester Performance Indicator System 1.... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108969 A security vulnerability has been detected in itsmeravitejak Online-Examination-... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108973 A vulnerability was determined in SourceCodester Contact Tracing System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-87679 When Brocade Fabric OS versions before 10.0.1 processes trunk configuration oper... |
high | 7.2 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-87680 A command injection vulnerability in the REST API management interface of Brocad... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-13 |
| CVE-2026-107295 Pydantic AI is a Python agent framework for building applications and workflows... |
high | 7.6 | — | Pydantic / pydantic ai | 2026-10-08 | 2026-10-13 |
| CVE-2026-103521 In Thelia v2.6.0, the document upload endpoint properly blocks the upload of exe... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-103522 In Thelia v2.6.0, the store banner upload feature performs insufficient filetype... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-104797 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104021 The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104723 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104725 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104766 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104899 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plug... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-93775 The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96667 The Real Estate Manager – Property Listing and Agent Management plugin for WordP... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96682 The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-107742 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plu... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-12626 The Online Scheduling and Appointment Booking System – Bookly plugin for WordPre... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-95684 The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-96558 The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPres... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.