October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,520
Critical
3,295
High
7,941
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-70276 Use after free in Microsoft Office Click-To-Run allows an authorized attacker to... |
high | 7.0 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102857 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-102856 Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized atta... |
high | 8.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-15 |
| CVE-2026-93885 The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPres... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-95816 The Smart Forms – when you need more than just a contact form plugin for WordPre... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-94197 An authentication and authorization bypass vulnerability exists in F5 NGINX Kube... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-93488 A flaw was found in Netty. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93491 A flaw was found in Netty's HttpServerCodec. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93558 A flaw was found in Netty's WebSocketServerExtensionHandler. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93564 A flaw was found in Netty. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-93565 A flaw was found in Netty RtspDecoder. |
high | 7.5 | — | — | 2026-09-18 | 2026-10-15 |
| CVE-2026-83592 The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-88043 The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Script... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-81534 The Email Customizer for WooCommerce (Pro) plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-77114 The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery... |
high | 7.3 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPre... |
high | 8.1 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vu... |
high | 7.2 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111091 In JetBrains Junie CLI before 26.8.3 code execution was possible via an untruste... |
high | 7.8 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-111093 In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the rep... |
high | 7.5 | — | — | 2026-10-15 | 2026-10-15 |
| CVE-2026-110284 The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordP... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108480 Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploit... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108483 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-108484 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107910 An improper authentication vulnerability in the is_authenticated function (src/b... |
high | 8.1 | — | — | 2026-10-09 | 2026-10-15 |
| CVE-2026-107631 The Record of Consent Extension for Complianz plugin for WordPress is vulnerable... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107751 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107867 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-105874 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-107421 Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhi... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104939 Description
NGINX Ingress Controller has a vulnerability when implementing an ex... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104767 The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-104764 The Post Export Import with Media plugin for WordPress is vulnerable to PHP Obje... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-102562 The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-15 |
| CVE-2026-103366 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103358 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
| CVE-2026-103081 Improper Control of Generation of Code ('Code Injection') vulnerability in Villa... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-15 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.