October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
24,105
Critical
3,260
High
7,834
Medium
7,482
Low
725
Severity not reported
4,804
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (116), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-88783 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widen... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-89236 The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and esc... |
high | 8.6 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-91078 The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publi... |
high | 8.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-105115 OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation v... |
high | 8.6 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93549 The CoCart WordPress plugin before 4.9.7 does not scope its REST API authenticat... |
high | 8.8 | — | — | 2026-10-04 | 2026-10-06 |
| CVE-2026-95265 Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in t... |
high | 7.5 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-78860 An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code v... |
high | 7.8 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-51888 langflow-ai langflow v1.8.4 is affected by: Directory Traversal. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-06 |
| CVE-2026-105783 Joplin is an open source note-taking and to-do application that organises notes... |
high | 8.0 | — | — | 2026-10-06 | 2026-10-06 |
| CVE-2026-105649 Ghost is a Node.js content management system. |
high | 7.3 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-104970 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105629 Plane is an open-source project management tool. |
high | 7.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-105634 Plane is an open-source project management tool. |
high | 8.1 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-94591 Armatura One stores database and message-broker credentials in an install config... |
high | 8.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-94592 Armatura One's database initialization routine assigns a fixed, vendor-defined p... |
high | 8.4 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-94593 Armatura One's backup and restore routine records the full database connection c... |
high | 7.8 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-97212 The WebSocket backend uses charging station identifiers to uniquely associate se... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-97363 The WebSocket Application Programming Interface lacks restrictions on the number... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-92025 Use-after-free in the DOM: Navigation component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92026 Use-after-free in the Networking component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92027 Use-after-free in the DOM: Streams component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-66269 Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use... |
high | 7.5 | — | Dell / openmanage server administrator | 2026-09-17 | 2026-10-06 |
| CVE-2026-92028 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-92029 Use-after-free in the SVG component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-15 | 2026-10-06 |
| CVE-2026-104988 A flaw was found in Dogtag PKI (pki-core). |
high | 8.1 | — | — | 2026-10-02 | 2026-10-06 |
| CVE-2026-77805 In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262... |
high | 7.9 | — | — | 2026-10-05 | 2026-10-06 |
| CVE-2026-93428 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96270 The Ultimate Member – User Profile, Registration, Login, Member Directory, Conte... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92536 The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-92977 The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is v... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97644 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress... |
high | 8.8 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101923 The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrar... |
high | 8.1 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-101928 The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stor... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-103913 The GeoDirectory plugin for WordPress is vulnerable to SQL Injection via the sto... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-87091 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-93430 The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96564 The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96575 The Transliterator – Multilingual and Multi-script Text Conversion plugin for Wo... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-96650 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site... |
high | 7.2 | — | — | 2026-10-03 | 2026-10-06 |
| CVE-2026-97337 The Simple Membership plugin for WordPress is vulnerable to unauthorized modific... |
high | 7.5 | — | — | 2026-10-03 | 2026-10-06 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.