October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,499
Critical
3,294
High
7,928
Medium
7,620
Low
739
Severity not reported
4,918
In CISA KEV
191
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-62030 Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versio... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62033 Subscriber Settings Change in uListing <= 2.2.0 versions. |
high | 7.6 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62034 Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Im... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62037 Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 version... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62038 Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62043 Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extensi... |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62064 Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62065 Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62066 Unauthenticated Local File Inclusion in Volos <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62067 Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62068 Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62069 Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62070 Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62074 Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62075 Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62082 Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62091 Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62092 Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62093 Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62094 Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62095 Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62096 Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62099 Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62100 Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62115 Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62116 Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & O... |
high | 7.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62117 Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.... |
high | 8.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62118 Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order... |
high | 7.3 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-62130 Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <=... |
high | 7.2 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-65459 Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. |
high | 7.5 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-66566 Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-78530 Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. |
high | 7.7 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-108479 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 8.1 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108481 Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress pat... |
high | 7.4 | — | — | 2026-10-12 | 2026-10-13 |
| CVE-2026-108179 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-109687 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.6 | — | — | 2026-10-13 | 2026-10-13 |
| CVE-2026-108549 cc-connect through 1.5.0 contains a missing authentication vulnerability in the... |
high | 8.1 | — | — | 2026-10-10 | 2026-10-13 |
| CVE-2026-102117 On deployments where the remote-support capability is licensed and enabled, an a... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102119 A path traversal weakness in an optional, non-default administrative feature all... |
high | 7.2 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
| CVE-2026-102143 An unauthenticated attacker could cause a file with attacker-controlled content... |
high | 7.5 | — | Accellion / kiteworks | 2026-09-30 | 2026-10-13 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.