October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
21,929
Critical
3,121
High
7,064
Medium
6,897
Low
608
Severity not reported
4,239
In CISA KEV
186
Most affected vendors (by CPE data where available): microsoft (1423), linux (722), google (413), ibm (321), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105639 Plane is an open-source project management tool. |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-95102 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to... |
critical | 9.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-84411 The web management service in affected RouterOS versions contains an integer und... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-79820 A remote user validation failure vulnerability exists in HPE Integrated Lights-O... |
critical | 9.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-87115 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92084 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for W... |
critical | 9.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105284 A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105285 A security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1... |
critical | 10.0 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105484 A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103355 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-103352 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-97283 Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP Advanc... |
critical | 9.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-32568 Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 ver... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32579 Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39753 Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39755 Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39757 Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39759 Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39761 Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39764 Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointme... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39770 Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39773 Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39797 Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versi... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41555 Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptio... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42415 Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42417 Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-82989 There is an input injection in vCast exposed network services in ViewSonic ViewB... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-103956 Missing authentication for critical function in the authentication dependency in... |
critical | 10.0 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-92018 Sandbox escape in the DOM: Core & HTML component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-100770 Sandbox escape due to use-after-free in the DOM: Content Processes component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-100775 Sandbox escape in the Graphics component. |
critical | 9.6 | — | Mozilla / firefox | 2026-09-29 | 2026-10-06 |
| CVE-2026-80441 IBM Guardium Data Protection 12.2 is vulnerable to an unauthenticated second-ord... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-81657 IBM Guardium Data Protection 12.2 could allow a remote unauthenticated attacker... |
critical | 9.8 | — | Ibm / guardium data protection | 2026-09-18 | 2026-10-06 |
| CVE-2026-86246 Initialization of a resource with an insecure default vulnerability in Apache To... |
critical | 9.1 | — | Apache / tomcat native | 2026-09-23 | 2026-10-06 |
| CVE-2026-56662 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
critical | 9.6 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-51922 agentscope v1.0.20 contains code injection in execute_shell_command (src/agentsc... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51898 sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.exec... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51906 In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image functio... |
critical | 9.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51915 TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in... |
critical | 9.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-51886 langflow-ai langflow v1.9.3 is affected by: Code Injection. |
critical | 9.8 | — | — | 2026-10-01 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.