October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-89073 Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. |
critical | 9.8 | — | Progress / moveit transfer | 2026-10-14 | 2026-10-19 |
| CVE-2026-86002 Dokku is a docker-powered platform as a service. |
critical | 9.0 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-59774 Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the re... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110645 Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110649 Stills before 25.24.2 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110650 The thumbnail Python package through 1.5 contains an OS command injection vulner... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110639 @mborne/extract before 0.2.1 contains an OS command injection vulnerability that... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110640 Whisper-node through 1.1.1 contains an OS command injection vulnerability that a... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110643 transcribe2texts through 1.0.6 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110644 nodejs-whisper through 0.3.1 contains an OS command injection vulnerability in c... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110634 git-diff before 2.0.7 contains an OS command injection vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110635 webp-converter before 3.0.0 contains an OS command injection vulnerability in sr... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-110636 pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110638 doc-recog through 1.1.6 contains an OS command injection vulnerability that allo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-110631 Komodo through 2.3.3 contains an authentication bypass vulnerability in the Peri... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-20 |
| CVE-2026-110612 vlife through 2.0.1 contains an authentication bypass vulnerability that allows... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2020-37282 office-converter through 1.0.2 contains an OS command injection vulnerability th... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-26 |
| CVE-2026-108065 SQL Injection (CWE-89) in the SOAP GetUser method of the /preapproval.asmx endpo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-16741 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-16740 Missing authentication for critical function vulnerability in TR7 Cyber Defense... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108291 Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107424 Incorrect Privilege Assignment vulnerability in M A Vinoth Kumar Frontend Dashbo... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103904 The public consent endpoint of JTL-Shop accepts arbitrary
consent names from una... |
critical | 9.3 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-104748 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-89310 A parameter taken from the request body is inserted into
a T-SQL statement witho... |
critical | 9.9 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-107594 The File Upload to Order WordPress plugin before 1.1.4 does not validate or conf... |
critical | 10.0 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-87855 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrar... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104800 The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-97657 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Aut... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97668 The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability |
critical | 9.8 | Listed | Collabora / Collabora Online – Built-in CODE Server | 2026-10-14 | 2026-10-30 |
| CVE-2026-110002 The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-92097 The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S... |
critical | 9.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-93388 The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnera... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110392 Improper neutralization of special elements used in an OS command ('OS command i... |
critical | 9.8 | — | — | 2026-10-14 | 2026-10-16 |
| CVE-2026-97381 Legacy Update is a tool for activating and installing updates on legacy Windows... |
critical | 9.9 | — | — | 2026-10-13 | 2026-10-17 |
| CVE-2026-110161 Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remo... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110165 Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 all... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110152 Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 a... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
| CVE-2026-110159 Incorrect authorization in Updater in Google Chrome prior to 155.0.8059.79 allow... |
critical | 9.6 | — | Google / chrome | 2026-10-13 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.