October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-110623 Papermerge Core through 3.5.3 contains a missing authorization vulnerability in... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110615 jshERP through 3.6 contains a missing authorization vulnerability in the POST /u... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-110616 NullHub through 2026.5.29 contains a missing authentication vulnerability that a... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110599 L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104939 Description
NGINX Ingress Controller has a vulnerability when implementing an ex... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2025-71433 Kaneo before 2.1.6 contains a missing authorization vulnerability that allows au... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-23 |
| CVE-2017-20286 DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il... |
high | 7.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2020-37281 Gravitee API Management through 4.12.22 contains an authentication bypass vulner... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-98419 In the Linux kernel, the following vulnerability has been resolved:
drop_monito... |
high | 7.0 | — | — | 2026-10-14 | 2026-10-24 |
| CVE-2026-98401 In the Linux kernel, the following vulnerability has been resolved:
net: iptunn... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-24 |
| CVE-2026-98405 In the Linux kernel, the following vulnerability has been resolved:
smb: client... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-24 |
| CVE-2026-110690 Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path trav... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-107870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-82026 Radar before 1.12.2 contains a missing authorization vulnerability in the handle... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-97278 Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang a... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107421 Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhi... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107426 Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey S... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105874 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-106599 Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart sur... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-76655 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote c... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73798 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107431 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-105067 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103905 The authentication middleware of the JTL-Shop
administration backend processes t... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104795 The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`)... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-30 |
| CVE-2026-103358 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-90954 A flaw was found in BusyBox's dpkg-deb archive extraction. |
high | 7.8 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86476 A flaw was found in gst-plugins-base. |
high | 8.4 | — | — | 2026-10-14 | 2026-11-05 |
| CVE-2026-107428 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73790 A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and sys... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109901 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110284 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92392 During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server
(... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-18 |
| CVE-2026-107631 The Record of Consent Extension for Complianz plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107751 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104764 The Post Export Import with Media plugin for WordPress is vulnerable to PHP Obje... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104909 The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.