October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,827
Critical
3,241
High
7,745
Medium
7,398
Low
707
Severity not reported
4,736
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-51907 In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function,... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103096 API
key is hardcoded and retrievable from the application package. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103097 An API key is
hardcoded and retrievable from the application package. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-85532 Apache WSS4J accepted attacker-controlled derived-key lengths and offsets withou... |
high | 7.5 | — | Apache / wss4j | 2026-09-30 | 2026-10-02 |
| CVE-2026-95326 Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95314 Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a... |
high | 8.1 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95285 Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-95278 Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowe... |
high | 8.4 | — | Google / chrome | 2026-09-29 | 2026-10-02 |
| CVE-2026-86344 A flaw was found in 389-ds-base. |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104861 probe-image-size gets image dimensions without downloading the entire file. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104020 Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 migh... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104123 A vulnerability was detected in SourceCodester Online Reviewer Management System... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103098 Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-94418 Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate sig... |
high | 7.5 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-93302 MatchTrustedPeer ignores the public key used, leading to forged CA clones passin... |
high | 8.2 | — | Wolfssl / wolfssl | 2026-09-27 | 2026-10-02 |
| CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write dat... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104057 Podgrab contains an unauthenticated denial-of-service vulnerability caused by un... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104059 Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability i... |
high | 8.1 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-53964 Document Merge Service is a document template merge service providing an API to... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that al... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103921 GraphQL Tools provides utilities for building, stitching, and mocking GraphQL sc... |
high | 7.4 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104018 An improper privilege management vulnerability (CWE-269) exists in the command s... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-68495 The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamRead... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-68496 The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamRea... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-104026 In Sapling SCM prior to v0.2.20260929-102736, control characters were allowed to... |
high | 7.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97663 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Store... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-96578 The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulner... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-97336 The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via '... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-95817 The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Sit... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-80298 Improper neutralization of special elements used in an SQL command ('SQL injecti... |
high | 8.8 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104414 Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerabil... |
high | 8.1 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104418 Ghost from 6.10.3 before 6.64.0 contains a remote code execution vulnerability t... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104422 The block sync download path in Zebra (zebrad) before 6.3.0 reads a block's heig... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-103426 The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site S... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104410 SiYuan before 3.8.5 contains an information disclosure vulnerability that allows... |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-104411 Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerabi... |
high | 7.3 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-100182 The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scr... |
high | 7.2 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-101888 The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path trave... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-02 |
| CVE-2026-91828 The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. |
high | 7.5 | — | — | 2026-10-02 | 2026-10-02 |
| CVE-2026-47297 Deserialization of untrusted data in SQL Server allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / sql server 2019 | 2026-09-08 | 2026-10-02 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.