October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,599
Critical
3,298
High
7,980
Medium
7,646
Low
740
Severity not reported
4,935
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-113143 Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a rem... |
high | 8.8 | — | Google / chrome | 2026-10-20 | 2026-10-29 |
| CVE-2026-104875 Ente provides end-to-end encrypted cloud services and security tools. |
high | 7.1 | — | — | 2026-10-13 | 2026-10-29 |
| CVE-2026-118650 Echo is a Go web framework. |
high | 7.5 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-113387 The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration... |
high | 8.6 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116099 A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplay... |
high | 8.8 | — | Fcs-ex / scp\ | 2026-10-26 | 2026-10-29 |
| CVE-2026-93521 A buffer overflow in RandR
ChangeProviderProperty requests in X.Org X Server bef... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93522 A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO pa... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-118510 A type-handling flaw in the relationship query building of this MongoDB integrat... |
high | 8.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-93523 A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-... |
high | 7.8 | — | — | 2026-10-28 | 2026-10-29 |
| CVE-2026-85874 Use after free in Windows Message Queuing Queue Manager allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-85879 Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux... |
high | 7.0 | — | Microsoft / windows subsystem for linux | 2026-10-13 | 2026-10-29 |
| CVE-2026-85884 Missing authentication for critical function in Windows Health and Optimized Exp... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83845 Improper privilege management in Windows Internet (wininet.dll) allows an author... |
high | 8.4 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83848 Untrusted pointer dereference in Windows COM+ Event System Service allows an aut... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83850 Heap-based buffer overflow in Microsoft Windows Search Component allows an autho... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-29 |
| CVE-2026-83851 Heap-based buffer overflow in Windows Partition Management Driver allows an unau... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-29 |
| CVE-2026-93757 The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypa... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93855 The SendPress Newsletters plugin for WordPress is vulnerable to time-based SQL I... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-93904 The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96228 SSL Wireless SMS Notification for WordPress is vulnerable to Authentication Bypa... |
high | 8.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96666 The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96669 The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerabl... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96741 The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-S... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-107743 The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scri... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-112827 Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Et... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-114193 Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115592 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115599 Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Ex... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115611 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115963 Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video vid... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115965 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115967 Weak Authentication vulnerability in Hamid Alinia Login with phone number login-... |
high | 8.8 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-116409 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-110184 The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the '... |
high | 7.5 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-115821 The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-96767 The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-29 | 2026-10-29 |
| CVE-2026-83852 Use after free in Windows Bind Filter Driver allows an authorized attacker to el... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-10-13 | 2026-10-29 |
| CVE-2026-112484 This issue was addressed with improved file handling. |
high | 7.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112457 A double free issue was addressed with improved memory management. |
high | 7.1 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
| CVE-2026-112438 A logic issue was addressed with improved state management. |
high | 8.8 | — | Apple / macos | 2026-10-26 | 2026-10-29 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.