October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-105848 Payload is a free and open source headless content management system. |
critical | 9.6 | — | Payloadcms / payload | 2026-10-06 | 2026-10-15 |
| CVE-2026-104070 The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulner... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-09 |
| CVE-2025-71383 Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-14 |
| CVE-2026-63691 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-67273 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper... |
critical | 9.6 | — | Dell / container storage modules | 2026-10-06 | 2026-10-20 |
| CVE-2026-105845 Payload is a free and open source headless content management system. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-63692 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing A... |
critical | 10.0 | — | Dell / container storage modules | 2026-10-06 | 2026-10-09 |
| CVE-2026-67269 Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains... |
critical | 9.9 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-61421 Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of H... |
critical | 9.8 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-63688 Dell Container Storage Modules (CSM), versions prior to v1.18.0, contains a Miss... |
critical | 10.0 | — | Dell / container storage modules | 2026-10-06 | 2026-10-08 |
| CVE-2026-105793 Microsoft UFO is an open-source framework for intelligent automation across devi... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-91140 An OS command injection vulnerability in the shell-based temporary-file cleanup... |
critical | 9.6 | — | — | 2026-10-06 | 2026-10-07 |
| CVE-2026-77178 Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bound... |
critical | 9.1 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106037 Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-106016 Mitigation bypass in the File Handling component. |
critical | 9.8 | — | Mozilla / firefox | 2026-10-06 | 2026-10-13 |
| CVE-2026-98365 In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: F... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-98323 In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: B... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-19 |
| CVE-2026-42415 Unauthenticated SQL Injection in Porto Theme - Functionality <= 3.9.3 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-42417 Unauthenticated SQL Injection in ARMember Premium <= 7.8 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-41555 Unauthenticated SQL Injection in Newsletter Subscription Form – User Subscriptio... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39795 Unauthenticated SQL Injection in SendPress Newsletters <= 1.26.1.20 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-28 |
| CVE-2026-39797 Unauthenticated PHP Object Injection in GDPR Framework By Data443 <= 2.5.0 versi... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39785 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-13 |
| CVE-2026-39770 Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39773 Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39761 Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39764 Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointme... |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39755 Subscriber Arbitrary File Upload in WP Duplicate <= 1.1.11 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39757 Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39759 Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39753 Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions. |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-39746 Unauthenticated SQL Injection in Booknetic <= 4.8.5 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-29 |
| CVE-2026-32579 Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-32557 Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. |
critical | 9.3 | — | — | 2026-10-06 | 2026-10-29 |
| CVE-2026-32568 Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 ver... |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-94293 An unauthenticated remote attacker can modify Asset Administration Shell submode... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105778 A vulnerability has been found in Tenda AC5 02.03.01.111_multi. |
critical | 9.9 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105484 A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230... |
critical | 10.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-82989 There is an input injection in vCast exposed network services in ViewSonic ViewB... |
critical | 9.8 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105763 Twenty is an open-source CRM (customer relationship management) platform. |
critical | 9.6 | — | — | 2026-10-06 | 2026-10-08 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.