October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (293), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105883 Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania all... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-104392 Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey M... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105318 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-105870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-105872 Deserialization of Untrusted Data vulnerability in mklacroix Product Configurato... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-103412 Improper limitation of a pathname to a restricted directory ('path traversal') v... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-103413 Improper input validation vulnerability in Apache Camel Karavan. |
high | 8.8 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-86463 Apache CXF's FIQL query parser has a vulnerability in how it searches for operat... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-97791 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-107937 In Apache CXF, the parser for multipart/MTOM attachment part headers did not ful... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-108039 By default, StaxUtils placed no limit on the total number of elements or the tot... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-73179 Improper enforcement of single-use authorization code semantics in the JPA OAuth... |
high | 8.1 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-78384 CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-20 |
| CVE-2026-100227 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's J... |
high | 7.5 | — | Apache / cxf | 2026-10-09 | 2026-10-16 |
| CVE-2026-96461 Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploitin... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96553 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-96607 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96671 Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from... |
high | 8.8 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96761 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96332 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96333 Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96336 Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminato... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95608 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95609 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95610 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-96329 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95591 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95596 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-95598 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95599 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-95607 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94641 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94661 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94663 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94664 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94666 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v... |
high | 7.5 | — | — | 2026-10-09 | 2026-10-11 |
| CVE-2026-94668 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94166 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94167 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-09 |
| CVE-2026-94170 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-09 | 2026-10-11 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.