October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,515
Critical
3,295
High
7,936
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-86799 The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values... |
high | 8.8 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-106043 A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-106047 A Path Traversal vulnerability in the template export functionality of Ivanti Xt... |
high | 7.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-101294 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 and IBM We... |
high | 8.7 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-73790 A vulnerability in HPE NonStop iTP WebServer can cause memory corruption and sys... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-73798 A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause... |
high | 8.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-76655 A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote c... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-23707 An Improper Neutralization of Special Elements used in an SQL Command ('SQL Inje... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-107390 music-metadata is a metadata parser for audio and video media files. |
high | 7.5 | — | Borewit / music-metadata | 2026-10-08 | 2026-10-14 |
| CVE-2026-103966 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103967 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104340 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104341 Adobe Framemaker is affected by an out-of-bounds write vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104342 Adobe Framemaker is affected by a Use After Free vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-104344 Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103844 Dimension is affected by an out-of-bounds write vulnerability that could result... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103845 Dimension is affected by an Uncontrolled Search Path Element vulnerability that... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103846 Dimension is affected by an Improper Neutralization of Input During Web Page Gen... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103847 Dimension is affected by an Untrusted Search Path vulnerability that could resul... |
high | 8.6 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103854 Dimension is affected by a Stack-based Buffer Overflow vulnerability that could... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100127 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100128 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-100129 Bridge is affected by an out-of-bounds write vulnerability that could result in... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-85431 MOOS essential-moos through version 10.0.1 contains an unauthenticated UDP packe... |
high | 7.5 | — | Themoos / essential-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-97398 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cros... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-95808 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-109519 A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. |
high | 8.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-109523 A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-103422 The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-100153 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripti... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-85429 MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the m... |
high | 7.5 | — | Mit / moos-ivp | 2026-09-03 | 2026-10-14 |
| CVE-2026-85432 MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB messag... |
high | 8.2 | — | Themoos / core-moos | 2026-09-03 | 2026-10-14 |
| CVE-2026-107428 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti... |
high | 7.1 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-107431 Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder... |
high | 7.5 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-97278 Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang a... |
high | 7.2 | — | — | 2026-10-14 | 2026-10-14 |
| CVE-2026-94578 Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerab... |
high | 8.8 | — | Broadcom / fabric operating system | 2026-10-08 | 2026-10-14 |
| CVE-2026-12613 Deserialization of untrusted data vulnerability in Ministry of Justice General D... |
high | 8.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-18390 Improper neutralization of special elements used in an OS command ('OS command i... |
high | 7.8 | — | — | 2026-10-12 | 2026-10-14 |
| CVE-2026-108967 A security flaw has been discovered in SourceCodester Performance Indicator Syst... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
| CVE-2026-108975 A security flaw has been discovered in SourceCodester Library Management System... |
high | 7.3 | — | — | 2026-10-13 | 2026-10-14 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.