October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,544
Critical
3,297
High
7,958
Medium
7,628
Low
740
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100792 JIT miscompilation in the JavaScript: WebAssembly component. |
high | 7.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100796 Use-after-free in the JavaScript: WebAssembly component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-100797 Privilege escalation due to use-after-free in the Graphics: WebRender component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-19 |
| CVE-2026-96627 Arcane is an interface for managing Docker containers, images, networks, and vol... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111901 phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consump... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111710 Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerabi... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-108374 ERPNext is a free and open source Enterprise Resource Planning tool. |
high | 7.7 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-101952 An Improper Validation of Consistency within Input vulnerability in the routing... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-19 |
| CVE-2026-102607 ZoneMinder is a free, open source closed-circuit television software application... |
high | 8.8 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-104734 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-107762 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordP... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109208 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-103899 The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-108123 The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to a... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-92798 The User Registration & Membership plugin for WordPress is vulnerable to Arbitra... |
high | 8.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-96660 The User Registration & Membership – Free & Paid Memberships, Subscriptions, Con... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110384 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-100316 The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-111110 The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for Wo... |
high | 7.2 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-110889 Generation of Error Message Containing Sensitive Information vulnerability in Ga... |
high | 7.5 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109701 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-17 | 2026-10-19 |
| CVE-2026-109895 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110383 Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature... |
high | 7.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110895 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-18 | 2026-10-19 |
| CVE-2026-110379 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-19 | 2026-10-19 |
| CVE-2026-84012 Double free in Remote Desktop Gateway Service allows an unauthorized attacker to... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84013 Use after free in Windows Telephony Server allows an authorized attacker to elev... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84014 Heap-based buffer overflow in Windows Device Association Service allows an autho... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84016 Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84017 Null pointer dereference in Windows Routing and Remote Access Service (RRAS) all... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-111675 Course-tencent-cloud through 2.0.1 contains an improper restriction of authentic... |
high | 7.4 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111680 APIPark through 1.9.7-beta contains an authorization bypass vulnerability that a... |
high | 8.3 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111685 IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability tha... |
high | 7.5 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111695 Shaiwz data-platform-open through commit efeacd3 contains an insecure direct obj... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111700 WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows a... |
high | 7.1 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-111650 ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the... |
high | 8.6 | — | — | 2026-10-16 | 2026-10-19 |
| CVE-2026-84018 Use after free in Windows Print Spooler Components allows an authorized attacker... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84019 Use after free in Windows Advanced Rasterization Platform allows an authorized a... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
| CVE-2026-84020 Use after free in Windows Routing and Remote Access Service (RRAS) allows an aut... |
high | 7.0 | — | Microsoft / windows 10 21h2 | 2026-10-13 | 2026-10-19 |
| CVE-2026-69880 Access of resource using incompatible type ('type confusion') in Desktop Window... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-10-13 | 2026-10-19 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.