October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,447
Low
659
Severity not reported
2,898
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (403), apple (294), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-97188 The String locator WordPress plugin before 2.6.8 does not restrict the classes a... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-82211 The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment r... |
high | 8.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-82212 The Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate t... |
high | 7.5 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-87782 The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is al... |
high | 8.8 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-87971 The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the U... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-105316 The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape... |
high | 7.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-104677 The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP c... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-59347 VMware Workstation and Fusion contain a stack-based buffer-overflow vulnerabilit... |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-102173 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-83540 When password or public key authentication is used with the Windows port of wolf... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-83742 Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v... |
high | 8.8 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-16516 wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host... |
high | 7.4 | — | Wolfssh / wolfssh | 2026-10-07 | 2026-10-13 |
| CVE-2026-106471 A flaw was found in Candlepin. |
high | 8.1 | — | — | 2026-10-07 | 2026-10-07 |
| CVE-2026-97673 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97674 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.1 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97676 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97678 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97679 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-97680 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.3 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93449 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93678 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 7.6 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-97655 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute a... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-88962 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93443 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93445 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-93447 IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the... |
high | 7.5 | — | Langflow / langflow | 2026-10-07 | 2026-10-08 |
| CVE-2026-104335 IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacke... |
high | 8.8 | — | Langflow / langflow | 2026-10-07 | 2026-10-09 |
| CVE-2026-106583 In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line us... |
high | 7.8 | — | Openbsd / openssh | 2026-10-07 | 2026-10-15 |
| CVE-2026-65142 NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause dese... |
high | 7.8 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-86684 The Gitea push mirror API checked whether the repository owner, instead of the r... |
high | 7.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106509 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106500 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106503 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-scaffolder-backend | 2026-10-06 | 2026-10-13 |
| CVE-2026-106505 Backstage is an open framework for building developer portals. |
high | 8.5 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-10-06 | 2026-10-09 |
| CVE-2026-106498 Backstage is an open framework for building developer portals. |
high | 7.7 | — | Linuxfoundation / backstage plugin-catalog-backend | 2026-10-06 | 2026-10-16 |
| CVE-2026-105267 The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requi... |
high | 8.1 | — | Gitea / gitea | 2026-10-06 | 2026-10-13 |
| CVE-2026-106553 In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failur... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106555 In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can in... |
high | 7.5 | — | Openbsd / openssh | 2026-10-06 | 2026-10-13 |
| CVE-2026-106550 Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Se... |
high | 7.5 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-106488 Backstage is an open framework for building developer portals. |
high | 8.1 | — | Linuxfoundation / backstage\/plugin-auth-backend-module-oidc-provider | 2026-10-06 | 2026-10-22 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.