October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-79828 A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execu... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-44084 An authorization bypass through user-controlled key vulnerability has been repor... |
high | 7.5 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-26245 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-26244 A SQL injection vulnerability has been reported to affect Video Station. |
high | 8.8 | — | Qnap / video station | 2026-10-15 | 2026-10-16 |
| CVE-2026-109855 undici is an HTTP client library for Node.js. |
high | 7.5 | — | Nodejs / undici | 2026-10-15 | 2026-10-19 |
| CVE-2024-22031 A vulnerability has been identified within Rancher where a user with the ability... |
high | 8.5 | — | — | 2026-10-15 | 2026-10-27 |
| CVE-2026-101290 A remote attacker may send a specially crafted network packet that causes the
af... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2023-32198 A vulnerability has been identified in Steve where by default it was using an in... |
high | 8.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101309 The xHCI (USB 3) device model did not validate or save the event ring size provi... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101310 The HDA audio device model did not check for zero-length Buffer Descriptor List... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-101311 The framebuffer device model's maximum resolution constants were duplicated betw... |
high | 7.0 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-81534 The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-96537 The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-58098 When semop(2) blocks waiting for a semaphore condition, it releases the per-set... |
high | 8.4 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58099 When copying knotes from a parent kqueue to a child, the copy code did not corre... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-58100 kqueue_fork_copy_knote() indexed into the child's file descriptor table using a... |
high | 7.0 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-19 |
| CVE-2026-74920 The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise a... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79821 A security vulnerability in HPE NonStop SOAP 4.0 may cause memory corruption res... |
high | 8.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-79822 A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruptio... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-101303 The IPv6 UDP send path for unconnected sockets did not apply the jail policy of... |
high | 7.5 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101304 When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N... |
high | 7.1 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-101305 renameat(2) did not enforce FD_RESOLVE_BENEATH on its directory arguments. |
high | 8.8 | — | Freebsd / freebsd | 2026-10-15 | 2026-10-20 |
| CVE-2026-88043 The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre... |
high | 8.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76665 A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory re... |
high | 7.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76663 A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause mem... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles token... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-19 |
| CVE-2026-110908 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-16 |
| CVE-2026-76660 A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds
write that can co... |
high | 8.7 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76661 A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can cor... |
high | 7.6 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77931 MoviePilot through 3.1.5 contains a command injection vulnerability that allows... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-26 |
| CVE-2026-73799 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory c... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-76066 IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypa... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-22 |
| CVE-2026-76659 A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-109430 Ellucian WebAdvisor 3.2 contains an unauthenticated XML External Entity (XXE) in... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-20 |
| CVE-2026-0993 SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vuln... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-16 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.