October 2026 CVE archive
Records published in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
17,481
Critical
1,390
High
6,087
Medium
6,446
Low
659
Severity not reported
2,899
In CISA KEV
21
Most affected vendors (by CPE data where available): microsoft (1359), google (759), oracle (376), apple (282), ibm (149), adobe (138), apache (73), imagemagick (72), broadcom (61), freerdp (60)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-6064 Link following vulnerability in Data Shredder components in Norton Antivirus, Av... |
high | 7.3 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-86377 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.6 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86378 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-110540 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.1 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-110541 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-103779 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.3 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2025-30414 Local privilege escalation due to improper authentication. |
high | 7.1 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-86389 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86393 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86394 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86379 Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86380 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86385 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, con... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-86395 Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86396 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86398 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-86399 Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-30 |
| CVE-2026-92797 The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery... |
high | 8.8 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-63286 Database backups are vulnerable to offline attacks. |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-110662 The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111111 The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Ad... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111120 The VikRentCar Car Rental Management System plugin for WordPress is vulnerable t... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109381 The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation i... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-109384 The The Innovative Form Builder – IvyForms plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-15323 The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111021 The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-111577 The GoSMTP WordPress plugin before 1.2.5 does not perform a settings-management... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-105972 The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise an... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-1928 The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress i... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-116613 The Animated Text Block plugin for WordPress is vulnerable to Sensitive Informat... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-111255 The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin... |
high | 7.5 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-97019 The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118375 llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in t... |
high | 8.1 | — | — | 2026-10-28 | 2026-11-03 |
| CVE-2026-118377 mews/pos through 2.0.0 contains an insufficient verification of data authenticit... |
high | 7.5 | — | — | 2026-10-28 | 2026-11-04 |
| CVE-2026-118378 Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite dr... |
high | 7.8 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-118370 libexpat through 2.9.0 contains a signed integer overflow vulnerability in store... |
high | 8.2 | — | Libexpat Project / libexpat | 2026-10-28 | 2026-11-02 |
| CVE-2026-117607 Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerabil... |
high | 7.2 | — | — | 2026-10-28 | 2026-11-02 |
| CVE-2026-117609 rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in pr... |
high | 7.1 | — | — | 2026-10-28 | 2026-10-28 |
| CVE-2026-117610 libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in exte... |
high | 7.5 | — | Libexpat Project / libexpat | 2026-10-28 | 2026-11-02 |
| CVE-2026-109999 The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer... |
high | 7.2 | — | — | 2026-10-28 | 2026-10-28 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.