October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,827
Critical
3,241
High
7,745
Medium
7,398
Low
707
Severity not reported
4,736
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100784 Use-after-free in the Layout: Text and Fonts component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applica... |
high | 7.4 | — | Envoyproxy / envoy | 2026-09-21 | 2026-10-05 |
| CVE-2026-100785 Use-after-free in the DOM: Core & HTML component. |
high | 8.8 | — | Mozilla / firefox | 2026-09-29 | 2026-10-05 |
| CVE-2026-88779 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memor... |
high | 7.5 | Listed | Citrix / NetScaler | 2026-10-04 | 2026-10-05 |
| CVE-2026-59685 Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while process... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-63045 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Softwar... |
high | 7.5 | — | Apache / http server | 2026-10-01 | 2026-10-05 |
| CVE-2026-103488 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenti... |
high | 7.1 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-103490 In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via... |
high | 7.2 | — | Jetbrains / youtrack | 2026-10-01 | 2026-10-05 |
| CVE-2026-80275 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-80276 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-05 |
| CVE-2026-103111 PCRE2 before 10.49, when there is an attacker-controlled regular expression and... |
high | 7.6 | — | — | 2026-09-30 | 2026-10-04 |
| CVE-2026-97342 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnera... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97641 The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97273 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-96871 The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96813 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugi... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-96566 The Newsletter – Send awesome emails from WordPress plugin for WordPress is vuln... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-96567 The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-95687 The WPC Shop as a Customer for WooCommerce plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-95670 The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Sc... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-93882 The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-93756 The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin fo... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-92245 The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-90438 The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-92174 The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Local File I... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-87920 The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scrip... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-85679 The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-62073 Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-19807 The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerabl... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-15983 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-03 |
| CVE-2026-15897 The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-10026 The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all ver... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-102565 The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-102772 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-101104 The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization f... |
high | 7.7 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-100107 The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-03 |
| CVE-2026-97508 In the Linux kernel, the following vulnerability has been resolved:
thunderbolt... |
high | 7.5 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97509 In the Linux kernel, the following vulnerability has been resolved:
thunderbolt... |
high | 8.8 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97496 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
high | 7.1 | — | — | 2026-09-24 | 2026-10-03 |
| CVE-2026-97497 In the Linux kernel, the following vulnerability has been resolved:
drm/amdkfd:... |
high | 7.8 | — | — | 2026-09-24 | 2026-10-03 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.