October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-52297 FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padd... |
high | 7.1 | — | Ffmpeg / ffmpeg | 2026-09-13 | 2026-10-14 |
| CVE-2026-17092 The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110622 Papermerge Core through 3.5.3 contains a missing authorization vulnerability tha... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109205 LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-109228 SGLang through 0.5.21 contains a resource budget bypass vulnerability that allow... |
high | 7.5 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108818 A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108806 A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922... |
high | 7.3 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-106599 Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart sur... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107426 Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey S... |
high | 7.3 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104749 The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-104909 The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100163 The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress... |
high | 7.4 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2025-14753 IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directori... |
high | 7.5 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2025-14754 IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitr... |
high | 8.8 | — | Ibm / cloud pak for data | 2026-09-18 | 2026-10-14 |
| CVE-2026-88064 Backstage is an open framework for building developer portals. |
high | 8.8 | — | Linuxfoundation / backstage plugin-techdocs-node | 2026-09-16 | 2026-10-14 |
| CVE-2026-110139 Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote... |
high | 8.8 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-110158 Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a re... |
high | 8.3 | — | Google / chrome | 2026-10-13 | 2026-10-14 |
| CVE-2026-73793 HPE NonStop Middleware software has secret key handling and data deserialization... |
high | 7.9 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-110207 Wukong AICRM through 20260610 contains a missing authorization vulnerability tha... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110233 Rovr through 0.10.3 on Windows contains an OS command injection vulnerability th... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110238 Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerabil... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108902 pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulne... |
high | 8.1 | — | — | 2026-10-11 | 2026-10-14 |
| CVE-2026-107701 dot-access through 1.0.0 contains a prototype pollution vulnerability that allow... |
high | 8.2 | — | — | 2026-10-08 | 2026-10-14 |
| CVE-2026-105442 IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Serv... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-97009 Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized atta... |
high | 7.8 | — | Microsoft / 365 apps | 2026-10-13 | 2026-10-14 |
| CVE-2026-92910 Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110208 Wukong AICRM through 20260610 contains a missing authorization vulnerability in... |
high | 7.1 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-110102 Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109704 Privilege escalation in the Application Update component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109739 Privilege escalation in the WebExtensions component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109743 Privilege escalation in the Panning and Zooming component. |
high | 8.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109620 A vulnerability has been found in SourceCodester Online Reviewer System 1.0. |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109901 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 8.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109605 A security vulnerability has been detected in SourceCodester Simple Cafe Billing... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104082 SmarterMail before build 9777 contains a remote code execution vulnerability tha... |
high | 7.2 | — | — | 2026-10-09 | 2026-10-14 |
| CVE-2026-103367 The ShopMagic – email automation for WordPress plugin for WordPress is vulnerabl... |
high | 8.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-103307 The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107126 The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107508 The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-s... |
high | 8.6 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-86787 The affiliate-toolkit WordPress plugin before 3.9.1 does not prevent a low-privi... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.