October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-94257 The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose pass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-77183 The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulne... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-83526 The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in a... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-28 |
| CVE-2026-87780 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87781 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-14335 The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plug... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104766 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104899 The GeoDirectory – WP Business Directory Plugin and Classified Listings Director... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104752 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate th... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104723 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104725 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-89301 The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulner... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104021 The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-104797 The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-92705 Aegisub is a cross-platform advanced subtitle editor. |
high | 7.8 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-57458 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-62376 Vikunja is an open-source self-hosted task management platform. |
high | 8.1 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108259 Tina is a headless content management system. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-108260 Tina is a headless content management system. |
high | 7.6 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75351 OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side Et... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75352 OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side Eth... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-75353 OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side E... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-19 |
| CVE-2026-75350 EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107837 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 8.2 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107838 RIOT is an open-source microcontroller operating system designed for Internet of... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107839 ageLANServer provides a cross-platform web server and launcher for offline multi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107840 yopass is a service for securely sharing secrets, passwords, and files. |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107823 MariaDB server is a community developed fork of MySQL server. |
high | 7.2 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107826 OWASP Coraza WAF is a golang modsecurity compatible web application firewall lib... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-16 |
| CVE-2026-107818 MariaDB server is a community developed fork of MySQL server. |
high | 8.4 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-107821 MariaDB server is a community developed fork of MySQL server. |
high | 8.0 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2026-75347 EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired poi... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108159 AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the des... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-13 |
| CVE-2026-108160 AstronRPA through 1.1.6 contains a download of code without integrity check vuln... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-55797 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-108156 LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-108157 Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vu... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-107815 MariaDB server is a community developed fork of MySQL server. |
high | 8.5 | — | Mariadb / mariadb | 2026-10-09 | 2026-10-14 |
| CVE-2025-61560 A race condition vulnerability in the SessionManager of CNCF: Cloud Native Compu... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-26 |
| CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. |
high | 8.2 | — | — | 2026-10-09 | 2026-10-09 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.