October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,586
Critical
3,105
High
6,983
Medium
6,767
Low
599
Severity not reported
4,132
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (410), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (113), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-42697 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42699 Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42704 Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42705 Unauthenticated Broken Access Control in Grand News <= 3.4 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42706 Unauthenticated Broken Access Control in DK <= 3.2.1 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42709 Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Onli... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42711 Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42712 Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions. |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42715 Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 v... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42717 Administrator SQL Injection in Leyka <= 3.32.3 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42722 Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42724 Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-42777 Unauthenticated Local File Inclusion in Aalto <= 1.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-45440 Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48193 Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48194 Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62020 Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62021 Subscriber PHP Object Injection in Angio <= 1.1.1 versions. |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62027 Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versio... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62030 Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versio... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62033 Subscriber Settings Change in uListing <= 2.2.0 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62034 Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Im... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62037 Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 version... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62038 Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62043 Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extensi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62064 Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62065 Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62066 Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62067 Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62068 Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62069 Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62070 Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62074 Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62075 Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62082 Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62091 Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62092 Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62093 Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62094 Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.