October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,513
Critical
3,295
High
7,934
Medium
7,624
Low
739
Severity not reported
4,921
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-85891 Exposure of sensitive information to an unauthorized actor in Azure HDInsight al... |
high | 7.5 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-84319 Nginx UI is a web user interface for the Nginx web server. |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-83844 Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute c... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-83781 Improper null termination in Windows Program Compatibility Assistant Service all... |
high | 7.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-83771 Use after free in Windows Camera Frame Server Monitor allows an unauthorized att... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-83746 Absolute path traversal in Skype for Business and Microsoft Lync allows an autho... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70297 Absolute path traversal in Skype for Business and Microsoft Lync allows an autho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70343 Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unautho... |
high | 8.8 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-70187 Use after free in Remote Desktop Gateway Service allows an unauthorized attacker... |
high | 8.1 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-100757 Use-after-free in the Widget component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-100759 Uninitialized memory in the Storage: Quota Manager component. |
high | 8.1 | — | Mozilla / firefox | 2026-09-29 | 2026-10-13 |
| CVE-2026-109201 LogicalDOC Community Edition through 9.3 contains a missing authorization vulner... |
high | 8.3 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109397 Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload... |
high | 7.2 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-109572 Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerabilit... |
high | 7.6 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-74035 Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnera... |
high | 7.2 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-104752 The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate th... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87780 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.8 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-87781 The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and esca... |
high | 8.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94256 The SMS Alert WordPress plugin before 4.0.1 does not verify that the account bei... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-94257 The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose pass... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-103305 The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103694 The Mobile builder WordPress plugin through 1.4.2 does not properly restrict whi... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-103695 The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-104680 The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user ho... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-106029 The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authori... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-14854 The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-su... |
high | 7.5 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-81420 The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a param... |
high | 8.6 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84258 The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not san... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84259 The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitis... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84260 The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not s... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-84261 The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-85126 The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks o... |
high | 7.2 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-86798 The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87760 The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or esca... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87761 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perfor... |
high | 8.0 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87762 The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have a... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-87764 The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88826 The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or C... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88827 The Disable Users WordPress plugin through 1.0.5 does not enforce its account-di... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
| CVE-2026-88903 The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of... |
high | 8.8 | — | — | 2026-10-11 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.