October 2026 CVE archive
Records last modified in NIST NVD between Oct 1 and Oct 31, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time. The modified view only includes records that were CRITICAL or CISA-KEV-listed when imported — it is not a complete list of every modification.
Total records
23,804
Critical
3,240
High
7,742
Medium
7,383
Low
706
Severity not reported
4,733
In CISA KEV
188
Most affected vendors (by CPE data where available): microsoft (1424), google (825), linux (722), ibm (323), oracle (193), mozilla (182), adobe (165), broadcom (118), apache (115), fabian (98)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-100514 Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-102378 Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 ve... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103068 Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <=... |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103687 A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-94390 Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 ver... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-95588 Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5... |
high | 8.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97260 Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97268 Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97277 Subscriber Broken Access Control in Social Boost <= 3.6.2 versions. |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97284 Contributor PHP Object Injection in Icegram <= 3.1.31 versions. |
high | 8.8 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97297 Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions. |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-56661 GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the... |
high | 7.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55230 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 8.7 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-55231 Vvveb is a powerful and easy to use CMS with page builder to build websites, blo... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103536 A vulnerability was identified in ZongXR Supermarket 1.0.0.0. |
high | 7.3 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103082 Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103247 n8n versions before 1.123.80 contain a credential tampering vulnerability where... |
high | 8.5 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103251 n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2... |
high | 7.1 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-103259 n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leak... |
high | 7.6 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2018-15982 Adobe Flash Player Use-After-Free Vulnerability |
high | 7.8 | Listed | Adobe / Flash Player | 2019-01-18 | 2026-10-01 |
| CVE-2026-85235 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin f... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-97661 The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to... |
high | 7.2 | — | — | 2026-10-01 | 2026-10-01 |
| CVE-2026-51853 agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in pytho... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-103472 restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-102796 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (b... |
high | 7.5 | — | — | 2026-09-27 | 2026-10-01 |
| CVE-2026-100242 Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consump... |
high | 7.5 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability |
high | 7.2 | Listed | Ivanti / Cloud Services Appliance (CSA) | 2024-10-08 | 2026-10-01 |
| CVE-2024-58387 Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /ap... |
high | 7.5 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability |
high | 7.5 | Listed | PaperCut / NG/MF | 2023-04-20 | 2026-10-01 |
| CVE-2022-27925 Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability |
high | 7.2 | Listed | Synacor / Zimbra Collaboration Suite (ZCS) | 2022-04-21 | 2026-10-01 |
| CVE-2021-22054 Omnissa Workspace ONE Server-Side Request Forgery |
high | 7.5 | Listed | Omnissa / Workspace One UEM | 2021-12-17 | 2026-10-01 |
| CVE-2017-6884 Zyxel EMG2926 Routers Command Injection Vulnerability |
high | 8.8 | Listed | Zyxel / EMG2926 Routers | 2017-04-06 | 2026-10-01 |
| CVE-2015-2291 Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability |
high | 7.8 | Listed | Intel / Ethernet Diagnostics Driver for Windows | 2017-08-09 | 2026-10-01 |
| CVE-2026-102299 Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote at... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-102301 Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a rem... |
high | 8.3 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-102302 Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote a... |
high | 8.8 | — | Google / chrome | 2026-09-29 | 2026-10-01 |
| CVE-2026-97395 Apache Polaris allows an authenticated principal with permission to create or up... |
high | 8.1 | — | — | 2026-09-29 | 2026-10-01 |
| CVE-2026-92172 Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to... |
high | 8.8 | — | — | 2026-09-30 | 2026-10-01 |
| CVE-2026-75886 A flaw was found in openshift/console. |
high | 7.2 | — | — | 2026-09-23 | 2026-10-01 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.