October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (286), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-108628 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sa... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-108623 JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the Sy... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-14 |
| CVE-2026-78534 Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66566 Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78530 Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78532 Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-65459 Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62117 Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.... |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62118 Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order... |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62130 Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <=... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62094 Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62095 Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62096 Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62099 Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62100 Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62115 Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62116 Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & O... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62082 Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62091 Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62092 Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62093 Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62065 Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62066 Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62067 Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62068 Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62069 Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62070 Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62074 Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62075 Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62038 Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62043 Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extensi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62064 Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62030 Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versio... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62033 Subscriber Settings Change in uListing <= 2.2.0 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62034 Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Im... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62037 Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 version... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-48194 Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-57742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62020 Unauthenticated Local File Inclusion in TouchUp < 1.4 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62021 Subscriber PHP Object Injection in Angio <= 1.1.1 versions. |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.